Proposed additions to ausearch

[Burn Alting]

Steve,

Before I send my patches out, I noticed in some testing of the svn code,
that some interpretation of the a2 and a3 keys has resulted in null
output if the raw data was 0. For example
raw:
        node=swtf5.swtf.dyndns.org type=SYSCALL
        msg=audit(1367146452.398:27817): arch=c000003e syscall=45
        success=no exit=-11 a0=6 a1=2546a04 a2=1000 a3=0 items=0
        ppid=798 pid=1227 auid=42 uid=42 gid=42 euid=42 suid=42 fsuid=42
        egid=42 sgid=42 fsgid=42 ses=1 tty=(none) comm="gnome-shell"
        exe=2F7573722F62696E2F676E6F6D652D7368656C6C202864656C6574656429
        subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key="all"
2.3 output
        < node=swtf5.swtf.dyndns.org type=SYSCALL msg=audit(04/28/2013
        20:54:12.398:27817) : arch=x86_64 syscall=recvfrom success=no
        exit=-11(Resource temporarily unavailable) a0=0x6 a1=0x2546a04
        a2=0x1000 a3=0x0 items=0 ppid=798 pid=1227 auid=gdm uid=gdm
        gid=gdm euid=gdm suid=gdm fsuid=gdm egid=gdm sgid=gdm fsgid=gdm
        ses=1 tty=(none) comm=gnome-shell exe=/usr/bin/gnome-shell
        (deleted) subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=all 
        ---
svn
        > node=swtf5.swtf.dyndns.org type=SYSCALL msg=audit(04/28/2013
        20:54:12.398:27817) : arch=x86_64 syscall=recvfrom success=no
        exit=-11(Resource temporarily unavailable) a0=0x6 a1=0x2546a04
        a2=0x1000 a3= items=0 ppid=798 pid=1227 auid=gdm uid=gdm gid=gdm
        euid=gdm suid=gdm fsuid=gdm egid=gdm sgid=gdm fsgid=gdm ses=1
        tty=(none) comm=gnome-shell exe=/usr/bin/gnome-shell (deleted)
        subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=all 

This appears to occur for recvfrom, sendmsg, sendto. I've yet to look
for other syscalls that it effects.

Rgds

On Tue, 2013-05-07 at 19:29 +1000, Burn Alting wrote:
> Thanks Steve,
> 
> I will check it out and re-fit patches over the next few days and submit
> individual patches for review.
> 
> Rgds
> 
> Burn
> 
> 
> On Mon, 2013-05-06 at 18:04 -0400, Steve Grubb wrote:
> > On Monday, May 06, 2013 09:53:40 AM Steve Grubb wrote:
> > > >         - a new option will print out more parser friendly output for
> > > >         interpreted mode
> > > 
> > > I am in the midst of coalescing the interpreters into one. I know this
> > > sounds  crazy, but ausearch and auparse both had independent copies of
> > > nearly the same material. The problem was they both keep data formatted
> > > completely different and that made combining them a challenge. I think
> > > auparse has a faster lookup algorithm but it allocates memory for the
> > > translation. So, I hope they cancel each other out.
> > > 
> > > My point in mentioning this is that I am probably in the middle of changing 
> > > code you hooked into. The work is checked in but still in progress. The
> > > first step was to create a common API for 3 functions used in translating
> > > fields. (This is checked in.) The next step is to link ausearch against
> > > auparse with the ausearch functions commented out. The final step is to
> > > remove all the unneeded code from ausearch. (I should be doing this today.)
> > 
> > All changes are checked into svn for this interpreter switch over. So far my 
> > testing shows that although ausearch malloc/frees about 6 times as much as it 
> > used to, the lookup algorithms in auparse are superior and we actually have 
> > about a 20% speed improvement in the outputting of interpreted results. 
> > Searching is not any faster. 
> > 
> > At this point, the code should be stable in this area if you want to retest 
> > and start sending patches.
> > 
> > Thanks,
> > -Steve
> 
> 
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit