AUDIT_NETFILTER_CFG event format
Steve Grubb
sgrubb at redhat.com
Thu Jan 19 13:45:02 UTC 2017
On Thursday, January 19, 2017 5:10:44 AM EST Richard Guy Briggs wrote:
> On 2017-01-17 10:42, Richard Guy Briggs wrote:
> > On 2017-01-17 09:07, Steve Grubb wrote:
> > > Hell Richard,
> > >
> > > While we're in the NETFILTER area, the CFG event is lacking some fields,
> > > too. Its currently:
> > >
> > > table,family,entries
> > >
> > > its missing everything about *who* sent it:
> > > pid,uid,auid,ses,subj,exe,res
> > >
> > > I'd suggest:
> > >
> > > pid,uid,auid,ses,subj,table,family,entries,exe,res
> > >
> > > to make it compatible with the majority of records.
> >
> > Ok, I've created an issue to track this:
> > https://github.com/linux-audit/audit-kernel/issues/35
>
> And I've just closed it since the associated SYSCALL setsockopt record
> lists all that information.
AUDIT_NETFILTER_CFG sometimes comes out of the kernel with no syscall record.
Try this,
ausearch --start today -m netfilter_cfg | less
You should see at least one that has no syscall record. This begs the question
of why there is even a SYSCALL record? AUDIT_NETFILTER_CFG is not extra
information that is gathered to help explain what the syscall means. Its a
change to system configuration in its own right. It should not be attached to a
syscall record - especially if its not consistent. It should be complete and
stand on its own.
Thanks,
-Steve
> > > Incidentally, I created a
> > > chart that shows how each record type is alike and different from every
> > > other record. You might call it a record grammar tree:
> > >
> > > http://people.redhat.com/sgrubb/audit/record-fields.html
> > >
> > > I'd like to align as many events as possible to pid,uid,auid section of
> > > the
> > > graph.
> > >
> > > -Steve
> >
> > - RGB
>
> - RGB
>
> --
> Richard Guy Briggs <rgb at redhat.com>
> Kernel Security Engineering, Base Operating Systems, Red Hat
> Remote, Ottawa, Canada
> Voice: +1.647.777.2635, Internal: (81) 32635
More information about the Linux-audit
mailing list