issue with file watches on Suse 10.1 using latest 2.6.18-rc4 and audit 1.2.3
Hello all,
I am trying to set up file watches for files such as /etc/passwd and /etc/shadow. I am using Suse 10.1. I have updated the kernel to a kernel.org 2.6.18-rc4 kernel, and have updated the audit userspace tools to version 1.2.3. I can add filesystem watches with "auditctl -w /etc/passwd" successfully now. Entries in the audit.log are created.
The first problem is that when I use "aureport -w", it tells me "<no events of interest were found>". Using "aureport -f" instead, it shows entries for /etc/passwd, but the auid column for all results is -1 (or "unset" if using the -i option to aureport). Looking at the audit logfile, auid=4294967295 which then correlates to -1 when used as a signed vs unsigned int.
How can I fix this?
Signature · 4 lines
Richard Warner Lead Systems Integrator Microway, Inc (508)732-5517
Quoted 8 lines · Rick Warner
Hello all,
I am trying to set up file watches for files such as
/etc/passwdand/etc/shadow. I am using Suse 10.1. I have updated the kernel to a kernel.org 2.6.18-rc4 kernel, and have updated the audit userspace tools to version 1.2.3. I can add filesystem watches with "auditctl -w/etc/passwd" successfully now. Entries in the audit.log are created.
Quoted 9 lines
The first problem is that when I use "aureport -w", it tells me "<no events of interest were found>". Using "aureport -f" instead, it shows entries for
/etc/passwd, but the auid column for all results is -1 (or "unset" if using the -i option to aureport). Looking at the audit logfile, auid=4294967295 which then correlates to -1 when used as a signed vs unsigned int.How can I fix this?
Rick,
I believe a special PAM package is used to capture the login uid (auid). I'm guessing that's where your problem lies.
-tim
Timothy R. Chavez wrote: [Thu Aug 10 2006, 11:04:29AM EDT]
Quoted 16 lines · Rick Warner
Quoted 15 lines
Hello all,
I am trying to set up file watches for files such as
/etc/passwdand/etc/shadow. I am using Suse 10.1. I have updated the kernel to a kernel.org 2.6.18-rc4 kernel, and have updated the audit userspace tools to version 1.2.3. I can add filesystem watches with "auditctl -w/etc/passwd" successfully now. Entries in the audit.log are created.The first problem is that when I use "aureport -w", it tells me "<no events of interest were found>". Using "aureport -f" instead, it shows entries for
/etc/passwd, but the auid column for all results is -1 (or "unset" if using the -i option to aureport). Looking at the audit logfile, auid=4294967295 which then correlates to -1 when used as a signed vs unsigned int.
Quoted 7 lines
Quoted 2 lines
How can I fix this?
Rick,
I believe a special PAM package is used to capture the login uid (auid). I'm guessing that's where your problem lies.
pam_loginuid(8) has some helpful info.