AUDIT_NETFILTER_CFG event format
Richard Guy Briggs
rgb at redhat.com
Thu Jan 19 10:10:44 UTC 2017
On 2017-01-17 10:42, Richard Guy Briggs wrote:
> On 2017-01-17 09:07, Steve Grubb wrote:
> > Hell Richard,
> >
> > While we're in the NETFILTER area, the CFG event is lacking some fields, too.
> > Its currently:
> >
> > table,family,entries
> >
> > its missing everything about *who* sent it:
> > pid,uid,auid,ses,subj,exe,res
> >
> > I'd suggest:
> >
> > pid,uid,auid,ses,subj,table,family,entries,exe,res
> >
> > to make it compatible with the majority of records.
>
> Ok, I've created an issue to track this:
> https://github.com/linux-audit/audit-kernel/issues/35
And I've just closed it since the associated SYSCALL setsockopt record
lists all that information.
> > Incidentally, I created a
> > chart that shows how each record type is alike and different from every other
> > record. You might call it a record grammar tree:
> >
> > http://people.redhat.com/sgrubb/audit/record-fields.html
> >
> > I'd like to align as many events as possible to pid,uid,auid section of the
> > graph.
> >
> > -Steve
>
> - RGB
- RGB
--
Richard Guy Briggs <rgb at redhat.com>
Kernel Security Engineering, Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635
More information about the Linux-audit
mailing list