<div dir="ltr"><div class="gmail_extra"><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div>On Tue, Oct 4, 2016 at 4:06 AM, Steve Grubb <span dir="ltr"><<a href="mailto:sgrubb@redhat.com" target="_blank">sgrubb@redhat.com</a>></span> wrote:<br></div></div></div></div></div></div></div></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-">On Sunday, October 2, 2016 11:00:16 AM EDT C.y wrote:<br>
> On Sun, Oct 2, 2016 at 12:20 AM, Steve Grubb <<a href="mailto:sgrubb@redhat.com">sgrubb@redhat.com</a>> wrote:<br>
</span><span class="gmail-">> > On Saturday, October 1, 2016 5:47:47 PM EDT C.y wrote:<br>
> > > Hi all,<br>
> > ><br>
> > ><br>
> > > I have fedora-server-24 installed on my raspberry-pi-3, following the<br>
> > > guide <a href="https://fedoraproject.org/wiki/Raspberry_Pi" rel="noreferrer" target="_blank">https://fedoraproject.org/<wbr>wiki/Raspberry_Pi</a>.<br>
> > ><br>
> > > Once I get my raspberry pi boot up, there were error mentioning that<br>
> > > "audit not support not in kernel", which I believed were then resolved after I<br>
> > > rebuild my kernel.<br>
> > ><br>
> > > However, I got stuck when I tried to add rule using `auditctl` command<br>
> > > as below:<br>
> > > `# auditctl -w /etc/passwd -p wa -k passwd_changes`<br>
> > > Error sending add rule data request (Invalid argument)<br>
> ><br>
> > Hmm. I wonder if 'ausyscall open' gives you syscalls.<br>
><br>
</span><span class="gmail-">> `# ausyscall open` returns as below. So I suppose the answer is<br>
> yes?(correct me if I'm wrong)<br>
> open 5<br>
> mq_open 274<br>
> openat 322<br>
> perf_event_open 364<br>
> open_by_handle_at 371<br>
<br>
</span>This means user space is doing the right thing. I am thinking this sounds like<br>
a kernel issue.<br>
<br>
Have you tried a few other simple commands?<br>
<br>
auditctl -e 1<br>
auditctl -s<br>
auditctl -always,exit -F arch=b64 -S open<br>
<br>
-Steve</blockquote><div> </div><div>`# auditctl -e 1` returns:</div><div><div>enabled 1</div><div>failure 1</div><div>pid 293</div><div>rate_limit 0</div><div>backlog_limit 64</div><div>lost 11</div><div>backlog 0</div><div>backlog_wait_time 6000</div></div><div><br></div><div>`# auditctl -s` returns:</div><div><div>enabled 1</div><div>failure 1</div><div>pid 293</div><div>rate_limit 0</div><div>backlog_limit 64</div><div>lost 11</div><div>backlog 0</div><div>backlog_wait_time 6000</div></div><div><br></div><div>`# auditctl -a always,exit -F arch=b64 -S open` returns:</div><div>arch elf mapping not found</div><div><br></div><div>`# auditctl -a always,exit -S open` returns:</div><div>Error sending add rule data request (Invalid argument)<br></div><div><br></div><div>I also noticed that auditd is having difficulty in parsing `/etc/auditd/auditd.rules`</div><div>on the booting stage, </div><div>`# journalctl -u auditd.service --this-boot` returns:</div><div><div>-- Logs begin at Fri 2016-02-12 00:28:01 CST, end at Tue 2016-10-04 10:53:05 CST. --</div><div>Feb 12 00:28:06 raspi3.lab systemd[1]: Starting Security Auditing Service...</div><div>Feb 12 00:28:06 raspi3.lab auditd[287]: Started dispatcher: /sbin/audispd pid: 301</div><div>Feb 12 00:28:06 raspi3.lab audispd[301]: priority_boost_parser called with: 4</div><div>Feb 12 00:28:06 raspi3.lab augenrules[288]: /sbin/augenrules: No change</div><div>Feb 12 00:28:06 raspi3.lab audispd[301]: max_restarts_parser called with: 10</div><div>Feb 12 00:28:06 raspi3.lab augenrules[288]: Error sending add rule data request (Invalid argument)</div><div>Feb 12 00:28:06 raspi3.lab augenrules[288]: There was an error in line 5 of /etc/audit/audit.rules</div><div>Feb 12 00:28:06 raspi3.lab augenrules[288]: No rules</div><div>Feb 12 00:28:06 raspi3.lab systemd[1]: Started Security Auditing Service.</div><div>Feb 12 00:28:06 raspi3.lab auditd[287]: Init complete, auditd 2.5.2 listening for events (startup state</div></div><div><br></div><div>while `# cat /etc/audit/rules.d` returns:</div><div>-----</div><div><div>## This file is automatically generated from /etc/audit/rules.d</div><div>-D</div><div><br></div><div><br></div><div>-a task,never</div></div><div>-----</div><div><br></div><div>p/s: On the log above, RaspberryPi is showing the wrong time due to a reboot, </div><div>the time will be corrected once the chronyd start functioning.</div><div><br></div><div><br></div><div>Regards,</div><div>CHING YI.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-">
> > > I tried to search for solution but it lead me to a bug that were already<br>
> > > been solved like years ago. Can anyone tell me if I am in the right way<br>
> > > of getting auditd works on raspberry pi? Were the problem I've faced were<br>
> > > already a known issue?<br>
> > ><br>
> > > Below are my system information and some logs/details when I tried to<br>
> > > diagnosis the problem and thanks a lot for your help in advance!<br>
> > ><br>
> > > `# uname -a`<br>
> > > Linux raspi3.lab 4.4.23-v7+ #2 SMP Sat Oct 1 15:24:41 CST 2016 armv7l<br>
> > > armv7l armv7l GNU/Linux<br>
> ><br>
> > I also wonder if we have a mismatch here. Is that armv seventy one or armv<br>
> > seven-el? Its coded in audit as seventy one.<br>
><br>
</span><span class="gmail-">> It's 7-el.<br>
> `# uname -a | grep 7l` (7-el) returns<br>
</span><span class="gmail-">> Linux raspi3.lab 4.4.23-v7+ #2 SMP Sat Oct 1 15:24:41 CST 2016 armv7l<br>
> armv7l armv7l GNU/Linux<br>
><br>
><br>
</span>> Sincerly,<br>
> CHING YI.<br>
<div class="gmail-HOEnZb"><div class="gmail-h5">><br>
> > -Steve<br>
> ><br>
> > > `# modprobe configs ; gunzip -dc /proc/config.gz | grep AUDIT`<br>
> > > CONFIG_AUDIT=y<br>
> > > CONFIG_NETFILTER_XT_TARGET_<wbr>AUDIT=m<br>
> > > CONFIG_AUDIT_GENERIC=y<br>
> > > # CONFIG_AUDIT_ARCH_COMPAT_<wbr>GENERIC is not set<br>
> > ><br>
> > > `# systemctl status auditd.service`<br>
> > > ● auditd.service - Security Auditing Service<br>
> > ><br>
> > > Loaded: loaded (/usr/lib/systemd/system/<wbr>auditd.service; enabled;<br>
> > > vendor preset: enabled)<br>
> > ><br>
> > > Active: active (running) since Fri 2016-02-12 00:28:07 CST; 7 months<br>
> > > 19 days ago<br>
> > ><br>
> > > Process: 1553 ExecReload=/bin/kill -HUP $MAINPID (code=exited,<br>
> > > status=0/SUCCESS)<br>
> > ><br>
> > > Process: 279 ExecStartPost=/sbin/augenrules --load (code=exited,<br>
> > > status=1/FAILURE)<br>
> > > Main PID: 278 (auditd)<br>
> > > CGroup: /system.slice/auditd.service<br>
> > > └─278 /sbin/auditd -n<br>
> > ><br>
> > > Oct 01 16:36:53 raspi3.lab auditd[278]: audit(1475311013.356:8458)<br>
> > > op=reconfigure state=changed auid=4294967295 pid=-1 subj=? res=success<br>
> > > Oct 01 16:36:53 raspi3.lab systemd[1]: Reloaded Security Auditing<br>
> > > Service.<br>
> > > Oct 01 16:37:28 raspi3.lab systemd[1]: Reloading Security Auditing<br>
> > > Service.<br>
> > > Oct 01 16:37:28 raspi3.lab auditd[278]: config change requested by<br>
> > > pid=-1<br>
> > > auid=4294967295 subj=?<br>
> > > Oct 01 16:37:28 raspi3.lab auditd[278]: audit(1475311048.046:257)<br>
> > > op=reconfigure state=changed auid=4294967295 pid=-1 subj=? res=success<br>
> > > Oct 01 16:37:28 raspi3.lab systemd[1]: Reloaded Security Auditing<br>
> > > Service.<br>
> > > Oct 01 16:38:18 raspi3.lab systemd[1]: Reloading Security Auditing<br>
> > > Service.<br>
> > > Oct 01 16:38:18 raspi3.lab auditd[278]: config change requested by<br>
> > > pid=-1<br>
> > > auid=4294967295 subj=?<br>
> > > Oct 01 16:38:18 raspi3.lab auditd[278]: audit(1475311098.716:2108)<br>
> > > op=reconfigure state=changed auid=4294967295 pid=-1 subj=? res=success<br>
> > > Oct 01 16:38:18 raspi3.lab systemd[1]: Reloaded Security Auditing<br>
> > > Service.<br>
> > ><br>
> > > While my `/var/log/audit/audit.log` was full with lines of<br>
> > > "SERVICE_START" & "SERVICE_STOP":<br>
> > > type=SERVICE_START msg=audit(1475313700.696:276): pid=1 uid=0<br>
> > > auid=4294967295 ses=4294967295 msg='unit=NetworkManager-<wbr>dispatcher<br>
> > > comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=?<br>
> > > terminal=? res=success'<br>
> > > type=SERVICE_STOP msg=audit(1475313710.836:277): pid=1 uid=0<br>
> > > auid=4294967295 ses=4294967295 msg='unit=NetworkManager-<wbr>dispatcher<br>
> > > comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=?<br>
> > > terminal=? res=success'<br>
> > ><br>
> > ><br>
> > > Sincerly,<br>
> > > CHING YI.<br></div></div></blockquote></div></div></div>