stime(2) auditing on x86_64

[Steve Grubb]

On Sunday 28 October 2007 05:51:03 pm Todd, Charles wrote:
> > That is because x86_64 does not have that syscall. It uses
> > settimeofday for the same functionality. But, it does exist
> > in the 32 bit compatibility layer.
>
> Okay, I understand the bi-arch thing except one thing: does that mean
> the 32-bit compatability layer is ultimately calling the 64-bit version?

Somewhere deeper inside, they probably share some code. But the audit hooks 
are at the entry/exit to the syscall. So, covering one does not cover the 
other. As Matt mentioned, you need 2 syscall rules explicitly stating bit 
size.


> > Not really, I think DISA is telling you the intent and that
> > needs to be interpretted/extended to cover bi-arch systems. 
>
> DISA's intent and their SRRs have always been two completely separate
> entities.  Testers only see that I don't have that flag, and less
> resourceful security folks won't know how to argue back.  Ultimately, we
> need to teach DISA to write better tests.

I'll be updating the sample audit rule sets in the next release to reflect 
both the subtree audit capability (since that's now merged in 2.6.24) and the 
bit sizing. Hopefully this updated rule set will trickle down to the right 
places.

-Steve