Bug 1296204
Summary: | RFE: Rebase audit package | |||
---|---|---|---|---|
Product: | Red Hat Enterprise Linux 7 | Reporter: | Steve Grubb <sgrubb> | |
Component: | audit | Assignee: | Steve Grubb <sgrubb> | |
Status: | CLOSED ERRATA | QA Contact: | Ondrej Moriš <omoris> | |
Severity: | medium | Docs Contact: | Mirek Jahoda <mjahoda> | |
Priority: | high | |||
Version: | 7.2 | CC: | bressers, ksrot, lmiksik, mjahoda, mmalik, omoris, plautrba, rsawhill, sgrubb, stormi | |
Target Milestone: | rc | Keywords: | FutureFeature, Rebase | |
Target Release: | --- | |||
Hardware: | Unspecified | |||
OS: | Unspecified | |||
Whiteboard: | ||||
Fixed In Version: | audit-2.6.5-3.el7 | Doc Type: | Rebase: Bug Fixes and Enhancements | |
Doc Text: |
_audit_ rebased to version 2.6.5
The _audit_ packages contain the user space utilities for storing and searching the audit records which have been generated by the audit subsystem in the Linux kernel. The _audit_ packages have been upgraded to upstream version 2.6.5, which provides a number of enhancements and bug fixes over the previous version. Notable changes include the following:
* The *audit* daemon now includes a new flush technique called `incremental_async`, which improves its performance approximately 90 times.
* The *audit* system now has many more rules that can be composed into an *audit* policy. Some of these new rules include support for the Security Technical Implementation Guide (STIG), PCI Data Security Standard, and other capabilities such as auditing the occurrence of 32-bit syscalls, significant power usage, or module loading.
* The `auditd.conf` configuration file and the "auditctl" command now support many new options.
* The *audit* system now supports a new log format called `enriched`, which resolves UID, GID, syscall, architecture, and network addresses. This will aid in log analysis on a machine that differs from where the log was generated.
|
Story Points: | --- | |
Clone Of: | ||||
: | 1350425 (view as bug list) | Environment: | ||
Last Closed: | 2016-11-04 06:13:10 UTC | Type: | Bug | |
Regression: | --- | Mount Type: | --- | |
Documentation: | --- | CRM: | ||
Verified Versions: | Category: | --- | ||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
Cloudforms Team: | --- | Target Upstream Version: | ||
Embargoed: | ||||
Bug Depends On: | ||||
Bug Blocks: | 1296594, 1313485 |
Description
Steve Grubb
2016-01-06 15:24:45 UTC
audit-2.6-2.el7 has been built to address this issue. Looks like bug 1118262 is fixed by upstream commit 1284 which is not in 2.6. For completeness, there is a format issue in audispd where protocol 1 events are missing the newline character. I'll need to do a patch. The following new major feature were tested: - BZ#1241634: Allow more syslog facilities in audispd-syslog - BZ#1135565: Add audit by process name support to auditctl - BZ#1127343: * Auditd support for enriched data: uid/gid, saddr splitting, arch, syscall * Make all libraries and utilities support and use enriched events * Fix interpretation of saddr fields when using enriched events - BZ#1271669, BZ#1271669 and BZ#1281545 * Update ausearch/report buffer size for locales with large time formats * Fix DST bug in ausearch/report time handling * Fix another DST bug in ausearch time conversion (#1334772) Other notable changes tested: - Have auditd do a fsync before closing log - Make default flush setting larger - In auditd, add incremental_async flushing mode - Updated and added audit rules - Create audit-stop.rules to clean up audit subsystem on stop - Add optional ExecStopPost to auditd.service to clear rules on service exit - Auditd fixup directory and file permissions on startup The complete list of changes between 2.4.5 and 2.6.5 can be found in upstream. changelog [1]. Sanity, regression testing and general errata check-list (specfile, integration, performance, etc.) passed audit-2.6.5-3.el7 and hence I consider this bug to be successfully verified. [1] https://people.redhat.com/sgrubb/audit/ChangeLog Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2418.html CVE-2015-5186 says "will not fix" but according to this bug report it is fixed, isn't it? I understand how that might appear to be inconsistent. If you look at the CVSS score, its only 4.3. This means that it is not severe enough to warrant an out of band security update. Instead, if there is a rebase of the package that picks up the fix, then its good for everyone but doesn't change the initial assessment. |