Re: ABI guarantee for auditd

hsultan
2015-01-16T02:20:43Z

On 2015-01-15 14:59, Steve Grubb wrote:
> On Thursday, January 15, 2015 02:34:16 PM hsultan@thefroid.net wrote:
>> On 2015-01-15 12:44, Steve Grubb wrote:
>> > On Thursday, January 15, 2015 12:24:38 PM hsultan@thefroid.net
>> wrote:
>> >> Regarding auditd, what is the ABI guarantee ? Do you guarantee
>> that
>> >> the
>> >> text contained in audit_reply->msg.data will always be the same
>> >> format ?
>> >> I imagine you reserve the right to add fields, but how about
>> >> removing
>> >> any or even reordering them ?
>> >
>> > Its happens on occasion. Requirements change, bugs are found, new
>> > features asked for.
>>
>> Thanks, that tells me most of what I need, one last thing : do you
>> happen to know if the 'big' distribs(Ubuntu,RH,CentOS,Debian...)
>> ship
>> those format changes only in new releases of their distribs, or do
>> they
>> include them in patches for existing releases as well ?
>
> I can't speak for other distributions, but if I find a mistake in the
> audit
> records, I fix it to be right rather than hold ABI and stay forever
> wrong. This
> doesn't happen very often. The audit records are mostly stable. But
> there are
> 155 different records.

Thanks for the info, so I tried using libauparse (again, Ubuntu 14.04
LTS), however I'm hitting something truly weird: once I've adddd the
event parsing code (taken from
https://fedorahosted.org/audit/browser/trunk/contrib/plugin/audisp-example.c
) and added -lauparse, what I get out of audit_get_reply now is
mangled.
That clearly can't be a code mistake because I didn't touch the event
retrieval code, it's totally separate and runs in a separate thread,
dropping the messages retrieved in a queue that the parser picks from.
Weird thing is, even if I comment out the parsing code, the problem
remains. Then I even remove the libauparse lib from the link settings
and rebuild from scratch, problem remains. BUT then I reboot the box,
and the SAME PROCESS (no recompiling, just a reboot) now shows events
properly again.

Is there a conflict or some specific setup between the 2 libraries I
should know about ? Does libauparse configures the audit infrastructure
in the kernel somehow ?

My libauparse version is 1:2.3.2-2ubuntu1 and from dpkg-query it lists
:

Breaks: libaudit0, libaudit1 (<< 1:2.2.1-2)

My libaudit is :
Version: 1:2.3.2-2ubuntu1

Thanks,

Hassan