On 15/01/14, Kangkook Jee wrote:
> Hi, all
Hi Kangkook,
> I have a question regarding how to interpret the audit message that we got for
> an open system call. In most cases, we observe a single item (path)
> information
> followed by 'syscall' and 'cwd' messages. However, in some cases, we see 2 or
> 3
> items (paths) followed by 'syscall' and 'cwd' messages like following cases.
>
> CASE 1:
>
> Jan 14 11:00:01 hostname kernel: [4980285.399982] type=1300
> audit(1421233201.056:893730395): arch=c000003e syscall=2 success=yes exit=5
> a0=7ffff4ae5830 a1=c2 a2=180 a3=2233546f14d99 items=2 ppid=983 pid=5723
> auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
> ses=4294967295 tty=(none) comm="cron" exe="/usr/sbin/cron" key=(null)
> Jan 14 11:00:01 hostname kernel: [4980285.399985] type=1307
> audit(1421233201.056:893730395): cwd="/var/spool/cron"
> Jan 14 11:00:01 hostname kernel: [4980285.399988] type=1302
> audit(1421233201.056:893730395): item=0 name="/tmp/" inode=40961 dev=ca:01
> mode=041777 ouid=0 ogid=0 rdev=00:00
> Jan 14 11:00:01 hostname kernel: [4980285.399990] type=1302
> audit(1421233201.056:893730395): item=1 name="/tmp/tmpfS9woiP" inode=30733
> dev=ca:01 mode=0100600 ouid=0 ogid=0 rdev=00:00
>
> CASE 2:
>
> Jan 14 11:19:37 hostname kernel: [4981461.529450] type=1300
> audit(1421234377.184:894228556): arch=c000003e syscall=2 success=yes exit=5
> a0=fa9700 a1=441 a2=1b6 a3=0 items=3 ppid=5727 pid=5728 auid=4294967295
> uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000
> fsgid=1000 ses=4294967295 tty=(none) comm="Run" exe="/usr/bin/perl" key=(null)
> Jan 14 11:19:37 hostname kernel: [4981461.529454] type=1307
> audit(1421234377.184:894228556):
> cwd="/home/ubuntu/benchmarks/UnixBench/testdir"
> Jan 14 11:19:37 hostname kernel: [4981461.529458] type=1302
> audit(1421234377.184:894228556): item=0
> name="/home/ubuntu/benchmarks/UnixBench/results/" inode=396144 dev=ca:01
> mode=040775 ouid=1000 ogid=1000 rdev=00:00
> Jan 14 11:19:37 hostname kernel: [4981461.529460] type=1302
> audit(1421234377.184:894228556): item=1 name=(null) inode=440344 dev=ca:01
> mode=0100664 ouid=1000 ogid=1000 rdev=00:00
> Jan 14 11:19:37 hostname kernel: [4981461.529463] type=1302
> audit(1421234377.184:894228556): item=2 name=(null) inode=440344 dev=ca:01
> mode=0100664 ouid=1000 ogid=1000 rdev=00:00
>
> I investigated audit source code a bit and found out that these are produced
> as
> a result of enumerations over audit_context.names_list data structure. But,
> I'm
> still not clear how and when entries for this data structure are filled.
There has been active work done recently to fix this problem. Your case
#2 is clearly an example of what we've been seeing.
Paul Moore sent a patch in early December and another at the end of
December, followed by a patchset from January 8th in an attempt to clean
things up for good:
https://www.redhat.com/archives/linux-audit/2014-December/msg00001.html
audit: correctly record file names with different path name
types
https://www.redhat.com/archives/linux-audit/2014-December/msg00108.html
audit: create private file name copies when auditing inodes
https://www.redhat.com/archives/linux-audit/2015-January/msg00016.html
"Overhaul the audit filename handling"
See also:
https://bugzilla.redhat.com/show_bug.cgi?id=1155208
> Could anyone explain what would it mean to have multiple items (paths) means
> for
> a single open syscall invocation?
Usually directory and file.
> Thanks a lot for your help in advance.
>
> Regards, Kangkook
- RGB
--
Richard Guy Briggs <rbri...@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red
Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
