On Sat, 2014-06-14 at 13:53 +0200, Laurent Bigonville wrote: > Le Thu, 5 Jun 2014 19:34:04 +0200, > Laurent Bigonville <bi...@debian.org> a écrit : > > > Le Wed, 04 Jun 2014 19:04:52 -0400, > > Steve Grubb <sgr...@redhat.com> a écrit : > [...] > > > You are missing a type=LOGIN event right here. If you do a "cat > > > /proc/self/loginuid" and its set to something besides -1, we have a > > > kernel bug. > > > > > > > > > Actually, my grepping was wrong, I'm seeing this the following line > > too: > > > > type=LOGIN msg=audit(1401921359.597:1397): pid=15760 uid=0 > > old-auid=4294967295 new-auid=1002 old-ses=4294967295 new-ses=66 res=1 > > Any idea here then? > > Regarding "/proc/self/loginuid" it's always set to the uid of the user > here. > > Looking at aulast code, I can see that there are differences for > kernels before or after 3.13. My machine is running 3.14, could this be > related?
Back in the olden-days we had: "pid=%d uid=%u old auid=%u new auid=%u old ses=%u new ses=%u res=%d" Which got complained about and resulted in: commit 5ee9a75c9fdaebd3ac8176f9f5c73fdcd27c1ad1 Author: Richard Guy Briggs <r...@redhat.com> Date: Wed Dec 11 15:28:09 2013 -0500 audit: fix dangling keywords in audit_log_set_loginuid() output Which gave us: "pid=%d uid=%u old-auid=%u new-auid=%u old-ses=%u new-ses=%u res=%d" And that is your record type. Steve asked Richard to remove the "new-" from the fields which resulted in commit aa589a13b5d00d3c643ee4114d8cbc3addb4e99f Author: Richard Guy Briggs <r...@redhat.com> Date: Mon Feb 24 12:31:11 2014 -0500 audit: remove superfluous new- prefix in AUDIT_LOGIN messages Which got us to today's record type: "pid=%d uid=%u subj=%s old-auid=%u auid=%u old-ses=%u ses=%u res=%d" My guess is that userspace just throws away record where it doesn't find the auid= and ses= and you kernel happens to live in those couple of months were it had "new-ses" and "new-auid" I'd call this a pretty clear userspace bug where it just completely drops records, even if it can't parse them... -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit