Bug 1353911
| Summary: | audisp writes bogus lines to its plugins | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Marius Vollmer <mvollmer> |
| Component: | audit | Assignee: | Steve Grubb <sgrubb> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 24 | CC: | omoris, plautrba, sgrubb, stefw |
| Target Milestone: | --- | Keywords: | Reopened |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | audit-2.6.5-1.fc24 audit-2.6.5-1.fc23 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-08-01 13:10:28 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1352611 | ||
Setting "log_format = ENRICHED" in /etc/auditd.conf seems to fix this. It should work with both RAW and ENRICHED. > It should work with both RAW and ENRICHED.
Yes, but it's broken with RAW. Or are you saying that you can't reproduce the bug?
(In reply to Marius Vollmer from comment #3) > > It should work with both RAW and ENRICHED. > > Yes, but it's broken with RAW. Or are you saying that you can't reproduce > the bug? No, no, I just wanted to say that it is still a bug even though it works with ENRICHED. I can reproduce it with 2.6.2-3. (In reply to Ondrej Moriš from comment #4) > No, no, I just wanted to say that it is still a bug even though it works > with ENRICHED. I can reproduce it with 2.6.2-3. Ahh, sorry for not reading carefully enough. Great that you can reproduce it! This is fixed in upstream commit 1335. I will be doing an audit package release today. This should be in rawhide soon after. audit-2.6.4-1.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-939e4bf1ee audit-2.6.4-1.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-e6aad21df2 This issue was caught by Cockpit integration tests. One can see it occurs here: https://github.com/cockpit-project/cockpit/issues/4678 There is still a problem in audispd. I'll respin the package with a patch when I solve the new problem. audit-2.6.4-2.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-e92dd01965 audit-2.6.4-2.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-b2a627d294 audit-2.6.4-2.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-e92dd01965 audit-2.6.4-2.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-b2a627d294 audit-2.6.4-2.fc24.x86_64 still generates malformed events with "msg=type=AVC" field when log_format is RAW audit-2.6.4-2.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report. (In reply to Petr Lautrbach from comment #15) > audit-2.6.4-2.fc24.x86_64 still generates malformed events with > "msg=type=AVC" field when log_format is RAW I can confirm this. audit-2.6.4-2.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report. Please test with audit-2.6.5-1 which is now in Fedora 24 updates-testing. Any objections to closing this? Setroubleshoot should be working now. Works for me. Successfully verified. # rpm -q audit audit-2.6.5-1.fc24.x86_64 # setenforce 1 # mkdir xxx # cd xxx # cp /usr/bin/ls ls # chcon -t httpd_exec_t ls # strace -e all -s100 -p $(pgrep audispd) >out 2>&1 & [1] 2307 # runcon -u system_u -r system_r -t httpd_t -- ./ls /home/ # cat out strace: Process 2180 attached futex(0x55e33046b124, FUTEX_WAIT_PRIVATE, 51, NULL) = 0 futex(0x55e33046b160, FUTEX_WAKE_PRIVATE, 1) = 0 sendto(5, "<14>Aug 1 08:54:57 audispd: node=intentionally_deleted type=AVC msg=audit(1470056097.645"..., 300, MSG_NOSIGNAL, NULL, 0) = 300 futex(0x55e33046b124, FUTEX_WAIT_PRIVATE, 53, NULL Thanks for reporting the issue and your patience. |
Description of problem: audisp writes lines to its plugins that auparse will reject. This causes sedispatch to miss all alerts. Version-Release number of selected component (if applicable): audit-2.6.2-1.fc24.x86_64 How reproducible: Always Steps to Reproduce: Listen to what audispd writes. # strace -e write -s100 -p $(pgrep audispd) Create some AVCs # setenforce 1 # mkdir xxx # cd xxx # cp /usr/bin/ls ls # chcon -t httpd_exec_t ls # runcon -u system_u -r system_r -t httpd_t -- ./ls /home/* Actual results: write(6, "node=localhost.localdomain type=AVC msg=type=AVC msg=audit(1467977545.048:251): avc: denied { read"..., 288) = 288 write(6, "node=localhost.localdomain type=AVC msg=type=AVC msg=audit(1467977545.050:252): avc: denied { read"..., 291) = 291 Note the "msg=type=AVC" part. It looks like "type=AVC msg=" is repeated. Expected results: write(6, "node=localhost.localdomain type=AVC msg=audit(1467978365.390:231): avc: denied { read } for pid=1"..., 275) = 275 write(6, "node=localhost.localdomain type=AVC msg=audit(1467978365.392:232): avc: denied { read } for pid=1"..., 277) = 277 This is what I get with audit-2.5.2-1.fc24.x86_64.