ABI guarantee for auditd

[hsultan at thefroid.net]

On 2015-01-15 14:59, Steve Grubb wrote:
> On Thursday, January 15, 2015 02:34:16 PM hsultan at thefroid.net wrote:
>> On 2015-01-15 12:44, Steve Grubb wrote:
>> > On Thursday, January 15, 2015 12:24:38 PM hsultan at thefroid.net 
>> wrote:
>> >> Regarding auditd, what is the ABI guarantee ? Do you guarantee 
>> that
>> >> the
>> >> text contained in audit_reply->msg.data will always be the same
>> >> format ?
>> >> I imagine you reserve the right to add fields, but how about
>> >> removing
>> >> any or even reordering them ?
>> >
>> > Its happens on occasion. Requirements change, bugs are found, new
>> > features asked for.
>>
>> Thanks, that tells me most of what I need, one last thing : do you
>> happen to know if the 'big' distribs(Ubuntu,RH,CentOS,Debian...) 
>> ship
>> those format changes only in new releases of their distribs, or do 
>> they
>> include them in patches for existing releases as well ?
>
> I can't speak for other distributions, but if I find a mistake in the 
> audit
> records, I fix it to be right rather than hold ABI and stay forever 
> wrong. This
> doesn't happen very often. The audit records are mostly stable. But 
> there are
> 155 different records.

Thanks for the info, so I tried using libauparse (again, Ubuntu 14.04 
LTS), however I'm hitting something truly weird: once I've adddd the 
event parsing code (taken from 
https://fedorahosted.org/audit/browser/trunk/contrib/plugin/audisp-example.c 
) and added -lauparse, what I get out of audit_get_reply now is 
mangled.
That clearly can't be a code mistake because I didn't touch the event 
retrieval code, it's totally separate and runs in a separate thread, 
dropping the messages retrieved in a queue that the parser picks from. 
Weird thing is, even if I comment out the parsing code, the problem 
remains. Then I even remove the libauparse lib from the link settings 
and rebuild from scratch, problem remains. BUT then I reboot the box, 
and the SAME PROCESS (no recompiling, just a reboot) now shows events 
properly again.

Is there a conflict or some specific setup between the 2 libraries I 
should know about ? Does libauparse configures the audit infrastructure 
in the kernel somehow ?

My libauparse version is 1:2.3.2-2ubuntu1 and from dpkg-query it lists 
:

Breaks: libaudit0, libaudit1 (<< 1:2.2.1-2)

My libaudit is :
Version: 1:2.3.2-2ubuntu1

Thanks,

Hassan