saddr value in connect()

[Steve Grubb]

On Mon, 05 May 2014 15:11:56 -0700
lists_todd at mac.com wrote:

> I have a question about the SOCKADDR token in a SYSCALL record
> (syscall 42 -- connect())
> 
> Most of my records begin with one of the two values:
> 	saddr=0200
> 	saddr=0100
> 
> Followed by the port & IPv4 address or the file path.

saddr is a hex encoded blob that is a struct sockaddr.

> QUESTION 1: The file path appears to be NULL terminated. Is this
> correct?

Its a socket address structure. It may or may not be null terminated
depending on the socket type.
 
> QUESTION 2: There is often additional characters after the 00
> termination (and IP address). Is this just garbage that should be
> ignored?

Its other fields in struct sockaddr.

> QUESTION 3: Sometimes the first byte in a file path is 00 termination
> (e.g., saddr=0100002F…). Does this mean the string is empty and the
> content following it is garbage? Or is there a bug that accidentally
> prepends the 00 to the front of the saddr sequence?

That would be an abstract af_unix socket.

-Steve

> Here is an example:
> 
> ————————
> type=SYSCALL msg=audit(1397089029.264:7407): arch=c000003e syscall=42
> success=yes exit=0 a0=3 a1=7fff3a7fdf70 a2=16 a3=7fff3a7fdd20 items=0
> ppid=805 pid=1064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="initctl"
> exe="/sbin/initctl" key=(null)
> 
> type=SOCKADDR msg=audit(1397089029.264:7407):
> saddr=0100002F636F6D2F7562756E74752F75707374617274 ————————
> 
> If I assume the first 00 is a bug, the string decodes to
> 
> 	/com/ubuntu/upstart
> 
> Thanks,
> 
> Todd
> 
> PS. uname -r gives 3.13.0-24-generic (though, I think I collected
> these logs before the last software update)
> 
> 
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit