<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1">
<title></title>
</head>
<body text="#000000" bgcolor="#ffffff">
Steve, <br>
Thanks for the reply. I must have something wrong with my system as
I can't get it to work even running it as root. I get an error of:<br>
<br>
FAILURE: errno = 22<br>
Error writing audit file: Invalid argument<br>
Error writing audit: Illegal seek<br>
<br>
Also how do I set auditd to allow other process(s) running not as root
to write to the netlink/kernel ( i.e. set CAP_AUDIT_WRITE)? I could not
find any info on this. Also where do I find these trusted app
examples? Is this something I down loa the src of Linux and look for?<br>
<br>
<br>
<br>
snip<br>
-----<br>
fd = audit_open();<br>
if (fd < 0)<br>
{<br>
printf("audit open failure, errno = %d\n", errno);<br>
}<br>
else<br>
{<br>
printf("audit file opened, fd = %d\n", fd);<br>
printf("attempting to write to audit log.\n");<br>
<br>
snprintf(msg, sizeof(msg), "My mesg to audit");<br>
<br>
if ((rc = audit_log_user_message(fd, 1101,<br>
msg, NULL, NULL, NULL, 0)) > 0)<br>
printf("SUCCESS: rc = %d\n", rc);<br>
else<br>
{<br>
printf("FAILURE: errno = %d\n", errno);<br>
perror( "Error writing audit file" );<br>
printf( "Error writing audit: %s\n", strerror( errno ) );<br>
}<br>
<br>
<br>
<br>
<br>
Steve Grubb wrote:<br>
<blockquote type="cite" cite="mid200703171659.20981.sgrubb@redhat.com">
<pre wrap="">On Saturday 17 March 2007 14:54:54 geckiv wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I was wondering if anyone had a good example of how to write to the
audit log on linux for a custom application wanting to log events.
</pre>
</blockquote>
<pre wrap=""><!---->
There's several examples in trusted apps. But its really simple to do. This is
from aide:
#ifdef WITH_AUDIT
if(nadd!=0||nrem!=0||nchg!=0){
int fd=audit_open();
if (fd>=0){
char msg[64];
snprintf(msg, sizeof(msg), "added=%ld removed=%ld changed=%ld",
nadd, nrem, nchg);
if (audit_log_user_message(fd, AUDIT_ANOM_RBAC_INTEGRITY_FAIL,
msg, NULL, NULL, NULL, 0)<=0)
#ifdef HAVE_SYSLOG
syslog(LOG_ERR, "Failed sending audit message:%s", msg);
#else
;
#endif
close(fd);
}
Being that I don't know what your app is doing, I'd say that you should use
the AUDIT_TRUSTED_APP event type. Also try to follow guidelines so that it
can be parsed correctly by tools:
<a class="moz-txt-link-freetext" href="http://people.redhat.com/sgrubb/audit/audit-parse.txt">http://people.redhat.com/sgrubb/audit/audit-parse.txt</a>
</pre>
<blockquote type="cite">
<pre wrap="">Does it write to the demon then write to the /var/log/auit/audit.log?
</pre>
</blockquote>
<pre wrap=""><!---->
No, it sends it to the kernel which decides what to do with it.
</pre>
<blockquote type="cite">
<pre wrap="">Also how do yo set this up so not just any one or any process write to that
log?
</pre>
</blockquote>
<pre wrap=""><!---->
The audit system is intended to be high integrity, meaning that its not able
to be written to by ordinary users. You have to have CAP_AUDIT_WRITE in order
to write to the audit system.
-Steve
</pre>
</blockquote>
</body>
</html>