Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 23 Sep 2006 13:31:32 +0100 (BST)
From:      Robert Watson <rwatson@FreeBSD.org>
To:        Joerg Pernfuss <elessar@bsdforen.de>
Cc:        stable@FreeBSD.org
Subject:   Re: Problems with auditd -- resolved
Message-ID:  <20060923130543.Y1938@fledge.watson.org>
In-Reply-To: <20060922025016.6bc38025@loki.starkstrom.lan>
References:  <20060917091750.T74654@fledge.watson.org> <20060922025016.6bc38025@loki.starkstrom.lan>

next in thread | previous in thread | raw e-mail | index | archive | help

On Fri, 22 Sep 2006, Joerg Pernfuss wrote:

> On Sun, 17 Sep 2006 09:19:03 +0100 (BST)
> Robert Watson <rwatson@FreeBSD.org> wrote:
>
>> I've just comitted a fix to syscalls.master and regenerated the remaining 
>> system call files, which should correct the auditctl: Invalid Argument 
>> error being returned by auditd.  In short order, this fix should be on the 
>> cvsup mirrors -- please let me know if it resolves the problem you were 
>> experiencing.
>
> Thank you for that quick fix Robert, but sadly I am still somewhat at a 
> loss. The auditd does run now, but does not write back any audit data at 
> all. I have run at least three full buildworlds during the time you see 
> below, set flags, deleted things, logged in, logged out, logged in via ssh 
> to the external interface, ssh'ed to localhost. No gain. /var/log/audit 
> looks like this:
<snip>
> My audit_control file:
> 	dir:/var/audit
> 	flags:all
> 	minfree:20
> 	naflags:lo
>
> My audit_user file:
> 	root:all:no
> 	elessar:all:no

This is somewhat troubling -- I have RELENG_6 audit running on a number of 
boxes without problems.  Your configuration looks reasonable, though.  There 
are a few things we can try.  The first thing to look at is whether the audit 
library and commands are having trouble parsing your configuration files for 
some reason -- maybe there is extra white space, and we need to increase 
tolerance of unexpected white space, for example.  There's a tool in 
src/contrib/openbsm/tools called audump, which parses the configuration files 
and then spits out what it thinks it found to stdout.  It's not built by 
default, but it can be quite useful when debugging.  You can build it by doing 
the following in the tools directory:

    -Wall -g -o /tmp/audump audump.c -lbsm

Then, as root, run:

    /tmp/audump control

I believe there's a bug in audump's user database support currently, but at 
the very least that will tell us if the control file is being properly parsed. 
Ideally, the output will very much resemble your configuration file -- if 
there's a significant difference, that could be the source of this problem.

Right now the id(1) command in -STABLE doesn't print audit properties of the 
process, but I've attached a patch that causes it to do so when "id -a" is 
run.  If you could apply this patch and run "id -a" as root, that would be 
helpful.

Robert N M Watson
Computer Laboratory
University of Cambridge

Index: Makefile
===================================================================
RCS file: /home/ncvs/src/usr.bin/id/Makefile,v
retrieving revision 1.11
diff -u -r1.11 Makefile
--- Makefile	19 May 2004 21:06:36 -0000	1.11
+++ Makefile	23 Sep 2006 12:23:40 -0000
@@ -1,10 +1,18 @@
  #	@(#)Makefile	8.1 (Berkeley) 6/6/93
  # $FreeBSD: src/usr.bin/id/Makefile,v 1.11 2004/05/19 21:06:36 dwmalone Exp $

+.include <bsd.own.mk>
+
  PROG=	id
  WARNS?=	6
  LINKS=	${BINDIR}/id ${BINDIR}/groups
  LINKS+=	${BINDIR}/id ${BINDIR}/whoami
  MAN=	id.1 groups.1 whoami.1

+.if ${MK_AUDIT} != "no"
+CFLAGS+=	-DUSE_BSM_AUDIT
+DPADD+=	${LIBBSM}
+LDADD+=	-lbsm
+.endif
+
  .include <bsd.prog.mk>
Index: id.1
===================================================================
RCS file: /home/ncvs/src/usr.bin/id/id.1,v
retrieving revision 1.15
diff -u -r1.15 id.1
--- id.1	29 Apr 2005 08:37:52 -0000	1.15
+++ id.1	23 Sep 2006 12:30:46 -0000
@@ -53,6 +53,8 @@
  .Fl P
  .Op Ar user
  .Nm
+.Fl a
+.Nm
  .Fl g Op Fl nr
  .Op Ar user
  .Nm
@@ -84,6 +86,9 @@
  Display the MAC label of the current process.
  .It Fl P
  Display the id as a password file entry.
+.It Fl a
+Display the process audit user ID and other process audit properties, which
+requires privilege.
  .It Fl g
  Display the effective group ID as a number.
  .It Fl n
Index: id.c
===================================================================
RCS file: /home/ncvs/src/usr.bin/id/id.c,v
retrieving revision 1.27
diff -u -r1.27 id.c
--- id.c	28 May 2006 12:32:30 -0000	1.27
+++ id.c	23 Sep 2006 12:30:16 -0000
@@ -48,6 +48,10 @@
  #include <sys/param.h>
  #include <sys/mac.h>

+#ifdef USE_BSM_AUDIT
+#include <bsm/audit.h>
+#endif
+
  #include <err.h>
  #include <errno.h>
  #include <grp.h>
@@ -60,6 +64,7 @@
  void	id_print(struct passwd *, int, int, int);
  void	pline(struct passwd *);
  void	pretty(struct passwd *);
+void	auditid(void);
  void	group(struct passwd *, int);
  void	maclabel(void);
  void	usage(void);
@@ -73,9 +78,11 @@
  	struct group *gr;
  	struct passwd *pw;
  	int Gflag, Mflag, Pflag, ch, gflag, id, nflag, pflag, rflag, uflag;
+	int aflag;
  	const char *myname;

  	Gflag = Mflag = Pflag = gflag = nflag = pflag = rflag = uflag = 0;
+	aflag = 0;

  	myname = strrchr(argv[0], '/');
  	myname = (myname != NULL) ? myname + 1 : argv[0];
@@ -89,7 +96,7 @@
  	}

  	while ((ch = getopt(argc, argv,
-	    (isgroups || iswhoami) ? "" : "PGMgnpru")) != -1)
+	    (isgroups || iswhoami) ? "" : "PGMagnpru")) != -1)
  		switch(ch) {
  		case 'G':
  			Gflag = 1;
@@ -100,6 +107,9 @@
  		case 'P':
  			Pflag = 1;
  			break;
+		case 'a':
+			aflag = 1;
+			break;
  		case 'g':
  			gflag = 1;
  			break;
@@ -125,7 +135,7 @@
  	if (iswhoami && argc > 0)
  		usage();

-	switch(Gflag + Pflag + gflag + pflag + uflag) {
+	switch(Gflag + Mflag + Pflag + aflag + gflag + pflag + uflag) {
  	case 1:
  		break;
  	case 0:
@@ -141,6 +151,16 @@
  	if (Mflag && pw != NULL)
  		usage();

+#ifdef USE_BSM_AUDIT
+	if (aflag) {
+		auditid();
+		exit(0);
+	}
+#else
+	if (aflag)
+		usage();
+#endif
+
  	if (gflag) {
  		id = pw ? pw->pw_gid : rflag ? getgid() : getegid();
  		if (nflag && (gr = getgrgid(id)))
@@ -278,6 +298,22 @@
  	printf("\n");
  }

+#ifdef USE_BSM_AUDIT
+void
+auditid(void)
+{
+	auditinfo_t auditinfo;
+
+	if (getaudit(&auditinfo) < 0)
+		err(-1, "getauditinfo");
+	printf("auid=%d\n", auditinfo.ai_auid);
+	printf("mask.success=0x%08x\n", auditinfo.ai_mask.am_success);
+	printf("mask.failure=0x%08x\n", auditinfo.ai_mask.am_failure);
+	printf("termid.port=0x%08x\n", auditinfo.ai_termid.port);
+	printf("asid=%d\n", auditinfo.ai_asid);
+}
+#endif
+
  void
  group(struct passwd *pw, int nflag)
  {
@@ -382,11 +418,16 @@
  	else if (iswhoami)
  		(void)fprintf(stderr, "usage: whoami\n");
  	else
-		(void)fprintf(stderr, "%s\n%s\n%s\n%s\n%s\n%s\n%s\n",
+		(void)fprintf(stderr, "%s\n%s\n%s\n%s%s\n%s\n%s\n%s\n",
  		    "usage: id [user]",
  		    "       id -G [-n] [user]",
  		    "       id -M",
  		    "       id -P [user]",
+#ifdef USE_BSM_AUDIT
+		    "       id -a\n",
+#else
+		    "",
+#endif
  		    "       id -g [-nr] [user]",
  		    "       id -p [user]",
  		    "       id -u [-nr] [user]");



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060923130543.Y1938>