Richard Guy Briggs
9d2161bed4
audit: log audit netlink multicast bind and unbind
Log information about programs connecting to and disconnecting from the
audit netlink multicast socket. This is needed so that during
investigations a security officer can tell who or what had access to the
audit trail. This helps to meet the FAU_SAR.2 requirement for Common
Criteria.
Here is the systemd startup event:
type=PROCTITLE msg=audit(2020-04-22 10:10:21.787:10) : proctitle=/init
type=SYSCALL msg=audit(2020-04-22 10:10:21.787:10) : arch=x86_64 syscall=bind success=yes exit=0 a0=0x19 a1=0x555f4aac7e90 a2=0xc a3=0x7ffcb792ff44 items=0 ppid=0 pid=1 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd exe=/usr/lib/systemd/systemd subj=kernel key=(null)
type=UNKNOWN[1335] msg=audit(2020-04-22 10:10:21.787:10) : pid=1 uid=root auid=unset tty=(none) ses=unset subj=kernel comm=systemd exe=/usr/lib/systemd/systemd nl-mcgrp=1 op=connect res=yes
And events from the test suite that just uses close():
type=PROCTITLE msg=audit(2020-04-22 11:47:08.501:442) : proctitle=/usr/bin/perl -w amcast_joinpart/test
type=SYSCALL msg=audit(2020-04-22 11:47:08.501:442) : arch=x86_64 syscall=bind success=yes exit=0 a0=0x7 a1=0x563004378760 a2=0xc a3=0x0 items=0 ppid=815 pid=818 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=perl exe=/usr/bin/perl subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=UNKNOWN[1335] msg=audit(2020-04-22 11:47:08.501:442) : pid=818 uid=root auid=root tty=ttyS0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 comm=perl exe=/usr/bin/perl nl-mcgrp=1 op=connect res=yes
type=UNKNOWN[1335] msg=audit(2020-04-22 11:47:08.501:443) : pid=818 uid=root auid=root tty=ttyS0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 comm=perl exe=/usr/bin/perl nl-mcgrp=1 op=disconnect res=yes
And the events from the test suite using setsockopt with NETLINK_DROP_MEMBERSHIP:
type=PROCTITLE msg=audit(2020-04-22 11:39:53.291:439) : proctitle=/usr/bin/perl -w amcast_joinpart/test
type=SYSCALL msg=audit(2020-04-22 11:39:53.291:439) : arch=x86_64 syscall=bind success=yes exit=0 a0=0x7 a1=0x5560877c2d20 a2=0xc a3=0x0 items=0 ppid=772 pid=775 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=perl exe=/usr/bin/perl subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=UNKNOWN[1335] msg=audit(2020-04-22 11:39:53.291:439) : pid=775 uid=root auid=root tty=ttyS0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 comm=perl exe=/usr/bin/perl nl-mcgrp=1 op=connect res=yes
type=PROCTITLE msg=audit(2020-04-22 11:39:53.292:440) : proctitle=/usr/bin/perl -w amcast_joinpart/test
type=SYSCALL msg=audit(2020-04-22 11:39:53.292:440) : arch=x86_64 syscall=setsockopt success=yes exit=0 a0=0x7 a1=SOL_NETLINK a2=0x2 a3=0x7ffc8366f000 items=0 ppid=772 pid=775 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=perl exe=/usr/bin/perl subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=UNKNOWN[1335] msg=audit(2020-04-22 11:39:53.292:440) : pid=775 uid=root auid=root tty=ttyS0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 comm=perl exe=/usr/bin/perl nl-mcgrp=1 op=disconnect res=yes
Please see the upstream issue tracker at
https://github.com/linux-audit/audit-kernel/issues/28
With the feature description at
https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Multicast-Socket-Join-Part
The testsuite support is at
https://github.com/rgbriggs/audit-testsuite/compare/ghak28-mcast-part-join
https://github.com/linux-audit/audit-testsuite/pull/93
And the userspace support patch is at
https://github.com/linux-audit/audit-userspace/pull/114
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
2020-04-27 18:49:31 -04:00
..
2019-11-05 12:44:34 +01:00
2020-01-21 11:41:36 +01:00
2020-03-24 14:39:45 +01:00
2020-03-27 18:32:37 +01:00
2019-10-04 14:25:17 -07:00
2020-03-15 15:20:16 +01:00
2019-10-04 14:25:17 -07:00
2019-10-04 14:25:17 -07:00
2019-11-21 11:44:06 -08:00
2020-03-17 16:04:49 +01:00
2019-12-18 18:07:31 +01:00
2020-04-27 18:49:31 -04:00
2020-01-01 00:00:33 +01:00
2020-01-01 00:00:33 +01:00
2020-01-23 11:40:01 -07:00
2019-11-07 06:31:50 -07:00
2020-03-30 17:36:33 -07:00
2020-01-10 17:20:07 +01:00
2019-11-18 17:51:49 +01:00
2020-03-23 17:02:00 +01:00
2019-11-05 12:44:34 +01:00
2020-01-28 10:09:51 +01:00
2019-10-07 07:55:17 -03:00
2019-10-01 17:19:41 -03:00
2019-10-09 22:31:14 -04:00
2019-09-25 17:51:39 -07:00
2020-03-26 15:10:44 +01:00
2019-11-15 14:38:29 +01:00
2019-10-28 13:41:01 -07:00
2020-03-30 17:54:58 -07:00
2020-03-03 11:10:21 -05:00
2019-12-17 21:37:40 +05:30
2019-11-15 14:38:29 +01:00
2019-11-15 14:38:29 +01:00
2020-03-29 22:32:37 -07:00
2020-03-29 22:32:36 -07:00
2020-03-25 23:17:16 +01:00
2020-01-18 09:19:18 -05:00
2020-03-16 08:26:58 -06:00
2020-03-19 21:56:54 -07:00
2019-10-23 14:26:37 +02:00
2019-11-05 18:20:55 -08:00
2020-03-25 09:50:44 +01:00
2019-12-11 15:31:52 +01:00
2020-03-11 15:08:52 +05:30
2020-02-29 21:52:20 -08:00
2019-12-26 13:09:37 -08:00
2020-03-20 08:52:20 -07:00
2020-03-30 19:52:37 -07:00
2020-03-16 01:42:31 -07:00
2020-01-21 11:41:36 +01:00
2020-03-11 23:49:30 -07:00
2020-03-29 22:14:48 -07:00
2020-04-06 20:56:50 -07:00
2019-12-13 15:00:36 -08:00
2020-03-21 14:03:46 -06:00
2019-10-15 13:34:43 +02:00
2020-03-29 22:30:57 -07:00
2020-01-04 13:55:09 -08:00
2020-03-26 11:09:04 +11:00
2020-03-29 22:30:57 -07:00
2020-02-07 14:39:38 +09:00
2020-03-20 09:01:16 +01:00
2020-03-17 22:51:16 -07:00
2020-04-02 09:35:30 -07:00
2020-03-29 22:14:49 -07:00
2019-11-15 14:38:29 +01:00
2020-03-02 11:16:28 -08:00
2020-03-29 22:32:36 -07:00
2020-03-18 16:35:48 -07:00
2020-03-20 14:42:20 +01:00
2019-11-06 06:17:38 +09:00
2020-01-18 09:19:18 -05:00
2020-02-16 19:34:44 -08:00
2020-02-20 22:44:30 -06:00
2020-04-02 17:57:10 +01:00
2020-03-27 10:41:44 -03:00
2019-10-02 20:32:27 -06:00
2020-03-30 11:06:49 -07:00
2020-03-26 20:08:45 -07:00
2019-12-01 14:00:59 -08:00
2019-10-23 17:23:47 +02:00
2020-01-28 10:09:51 +01:00
2019-10-26 02:09:58 +11:00
2019-11-15 12:48:32 -08:00
2020-01-07 16:07:01 -05:00
2019-11-15 14:38:29 +01:00
2020-03-29 22:30:57 -07:00
2020-03-29 22:30:57 -07:00
2020-03-26 21:38:40 +01:00
2020-01-15 13:48:18 +01:00
2019-12-04 19:44:12 -08:00
2020-02-12 17:57:51 -05:00
2019-11-08 14:18:32 -08:00
2020-03-04 14:48:54 -08:00
2019-11-04 07:11:31 -07:00
2019-11-15 14:38:29 +01:00
2019-10-16 06:11:24 -07:00
2020-03-24 15:59:34 -07:00
2019-11-15 14:38:29 +01:00
2020-01-26 15:28:47 +01:00
2020-02-27 18:50:19 -08:00
2019-11-13 12:15:34 -08:00
2020-02-21 11:22:15 -08:00
2020-01-15 11:00:39 -06:00
2020-01-31 10:30:39 -08:00
2019-12-18 18:07:31 +01:00
2020-03-09 17:56:33 -07:00
2020-01-04 13:49:51 +08:00
2019-12-18 18:07:33 +01:00
2020-02-21 11:22:15 -08:00
2019-12-18 18:07:33 +01:00
2019-10-04 14:25:17 -07:00
2019-12-20 21:18:42 -08:00
2019-11-08 14:01:59 -08:00
2019-12-09 09:59:07 +01:00
2020-03-29 23:29:08 +02:00
2020-04-07 10:43:39 -07:00
2019-11-15 14:38:29 +01:00
2020-02-24 16:12:28 +01:00
2020-03-24 09:28:27 -06:00
2020-04-02 10:41:40 -04:00
2020-04-02 10:41:40 -04:00
2020-03-20 09:00:56 +01:00
2020-04-07 10:43:39 -07:00
2020-03-20 14:42:19 +01:00
2020-03-27 11:09:18 +01:00
2020-03-23 09:50:02 -04:00
2019-10-04 14:25:17 -07:00
2019-12-11 15:01:23 -08:00
2019-12-16 19:22:22 -08:00
2019-12-13 10:45:35 +01:00