Writtign to audit with an application

DISCUSSION geckiv 2 participants 8 messages Mar 17, 2007 – Mar 19, 2007

Share & tools

geckiv

author

2007-03-17 18:54 UTC #0 lore raw

I was wondering if anyone had a good example of how to write to the audit log on linux for a custom application wanting to log events. Also how that would work. I found a little information but I have been unable to get anything to work properly. Does it write to the demon then write to the /var/log/auit/audit.log? Also how do yo set this up so not just any one or any process write to that log?

Thanks,

Frank

Steve Grubb

2007-03-17 20:59 UTC #1 lore raw

Quoted 2 lines · On Saturday 17 March 2007 14:54:54 geckiv wrote:

I was wondering if anyone had a good example of how to write to the audit log on linux for a custom application wanting to log events.

There's several examples in trusted apps. But its really simple to do. This is from aide:

#ifdef WITH_AUDIT

  if(nadd!=0||nrem!=0||nchg!=0){
    int fd=audit_open();
    if (fd>=0){
       char msg[64];

       snprintf(msg, sizeof(msg), "added=%ld removed=%ld changed=%ld", 
                nadd, nrem, nchg);

       if (audit_log_user_message(fd, AUDIT_ANOM_RBAC_INTEGRITY_FAIL,
                                  msg, NULL, NULL, NULL, 0)<=0)
#ifdef HAVE_SYSLOG
          syslog(LOG_ERR, "Failed sending audit message:%s", msg);
#else
          ;
#endif
       close(fd);
    }

Being that I don't know what your app is doing, I'd say that you should use the AUDIT_TRUSTED_APP event type. Also try to follow guidelines so that it can be parsed correctly by tools:

http://people.redhat.com/sgrubb/audit/audit-parse.txt

Quoted 1 line

Does it write to the demon then write to the /var/log/auit/audit.log?

No, it sends it to the kernel which decides what to do with it.

Quoted 2 lines

Also how do yo set this up so not just any one or any process write to that log?

The audit system is intended to be high integrity, meaning that its not able to be written to by ordinary users. You have to have CAP_AUDIT_WRITE in order to write to the audit system.

-Steve

geckiv

author

2007-03-17 21:35 UTC #2 lore raw

Re: Writting to audit with an application

Steve, Thanks for the reply. I must have something wrong with my system as I can't get it to work even running it as root. I get an error of:

FAILURE: errno = 22
Error writing audit file: Invalid argument
Error writing audit: Illegal seek

Also how do I set auditd to allow other process(s) running not as root to write to the netlink/kernel ( i.e. set CAP_AUDIT_WRITE)? I could not find any info on this. Also where do I find these trusted app examples? Is this something I down loa the src of Linux and look for?

snip
-----
fd = audit_open();
if (fd < 0)

   {
       printf("audit open failure, errno = %d\n", errno);
   }
   else
   {
       printf("audit file opened, fd = %d\n", fd);
       printf("attempting to write to audit log.\n");

      snprintf(msg, sizeof(msg), "My mesg to audit");

       if ((rc = audit_log_user_message(fd, 1101,
           msg, NULL, NULL, NULL, 0)) > 0)
           printf("SUCCESS:  rc = %d\n", rc);
       else
       {
           printf("FAILURE:  errno = %d\n", errno);
           perror( "Error writing audit file" );
           printf( "Error writing audit: %s\n", strerror( errno ) );
       }

Quoted 55 lines · Steve Grubb

Quoted 4 lines · On Saturday 17 March 2007 14:54:54 geckiv wrote:
I was wondering if anyone had a good example of how to write to the audit log on linux for a custom application wanting to log events.
There's several examples in trusted apps. But its really simple to do. This is from aide:
#ifdef WITH_AUDIT
 if(nadd!=0||nrem!=0||nchg!=0){
   int fd=audit_open();
   if (fd>=0){
      char msg[64];

      snprintf(msg, sizeof(msg), "added=%ld removed=%ld changed=%ld", 
               nadd, nrem, nchg);

      if (audit_log_user_message(fd, AUDIT_ANOM_RBAC_INTEGRITY_FAIL,
                                 msg, NULL, NULL, NULL, 0)<=0)
#ifdef HAVE_SYSLOG
         syslog(LOG_ERR, "Failed sending audit message:%s", msg);
#else
         ;
#endif
      close(fd);
}
Being that I don't know what your app is doing, I'd say that you should use the AUDIT_TRUSTED_APP event type. Also try to follow guidelines so that it can be parsed correctly by tools:
http://people.redhat.com/sgrubb/audit/audit-parse.txt
Quoted 3 lines
Does it write to the demon then write to the /var/log/auit/audit.log?
No, it sends it to the kernel which decides what to do with it.
Quoted 4 lines
Also how do yo set this up so not just any one or any process write to that log?
The audit system is intended to be high integrity, meaning that its not able to be written to by ordinary users. You have to have CAP_AUDIT_WRITE in order to write to the audit system.
-Steve

Steve Grubb

2007-03-17 22:24 UTC #3 lore raw

Re: Writting to audit with an application

Quoted 6 lines · On Saturday 17 March 2007 17:34:57 geckiv wrote:

Thanks for the reply. I must have something wrong with my system as I can't get it to work even running it as root. I get an error of:
FAILURE: errno = 22
Error writing audit file: Invalid argument
Error writing audit: Illegal seek

This does sound wrong. Maybe strace would shed some light on how its going wrong? What kernel are you using?

Quoted 2 lines

Also how do I set auditd to allow other process(s) running not as root to write to the netlink/kernel ( i.e. set CAP_AUDIT_WRITE)?

You can't. The audit system is designed to be high integrity meaning only trusted apps or processes that run as root or started as root but dropped privileges keeping CAP_AUDIT_WRITE. The audit event is written to the kernel, not auditd (meaning the kernel must be compiled with syscall audit support at a minimum). The kernel may decide to give the event to auditd.

Quoted 2 lines

I could not find any info on this. Also where do I find these trusted app examples?

dbus, nscd, passwd, shadow-utils, pam, ...

Quoted 1 line

Is this something I down loa the src of Linux and look for?

No, dbus is an example of a program that keeps CAP_AUDIT_WRITE after starting as root but changes uids. passwd is setuid root. pam runs as part of applications that stay root.

-Steve

geckiv

author

2007-03-19 21:29 UTC #4 lore raw

Re: Writting to audit with an application

Steve,
I never heard of dbus before. Is there an example how it keeps it's
CAP_AUDIT_WRITE and changes uids? Is this just using setuid() some how?

Thanks,

Frank

Quoted 45 lines · Steve Grubb

Quoted 8 lines · On Saturday 17 March 2007 17:34:57 geckiv wrote:
Thanks for the reply. I must have something wrong with my system as I can't get it to work even running it as root. I get an error of:
FAILURE: errno = 22
Error writing audit file: Invalid argument
Error writing audit: Illegal seek
This does sound wrong. Maybe strace would shed some light on how its going wrong? What kernel are you using?
Quoted 4 lines
Also how do I set auditd to allow other process(s) running not as root to write to the netlink/kernel ( i.e. set CAP_AUDIT_WRITE)?
You can't. The audit system is designed to be high integrity meaning only trusted apps or processes that run as root or started as root but dropped privileges keeping CAP_AUDIT_WRITE. The audit event is written to the kernel, not auditd (meaning the kernel must be compiled with syscall audit support at a minimum). The kernel may decide to give the event to auditd.
Quoted 4 lines
I could not find any info on this. Also where do I find these trusted app examples?
dbus, nscd, passwd, shadow-utils, pam, ...
Quoted 3 lines
Is this something I down loa the src of Linux and look for?
No, dbus is an example of a program that keeps CAP_AUDIT_WRITE after starting as root but changes uids. passwd is setuid root. pam runs as part of applications that stay root.
-Steve

Steve Grubb

2007-03-19 21:38 UTC #5 lore raw

Re: Writting to audit with an application

Quoted 2 lines · geckiv

I never heard of dbus before. Is there an example how it keeps it's CAP_AUDIT_WRITE and changes uids?

Not without looking at its source code. Here's its patch:

http://developer.momonga-linux.org/viewvc/trunk/pkgs/dbus/dbus-0.61-selinux-avc-audit.patch?r1=13947&r2=13946&pathrev=13947&view=patch

nscd also does the same trick, but its coded in glibc style.

Quoted 1 line

Is this just using setuid() some how?

No, there's an intricate dance regarding setuid, prctl, & capabilities that must be followed exactly or bad things can happen.

-Steve

Steve Grubb

2007-03-17 22:50 UTC #6 lore raw

Re: Writting to audit with an application

In reply to geckiv

Quoted 2 lines · On Saturday 17 March 2007 17:34:57 geckiv wrote:

FAILURE: errno = 22
Error writing audit file: Invalid argument

I bet this is the problem. ^^^^ EINVAL. That can be bad arguments or sometimes a permission problem from selinux.

Quoted 1 line

Error writing audit: Illegal seek

This was probably a changed errno from perror.

-Steve

geckiv

author

2007-03-18 21:15 UTC #7 lore raw

Re: Writting to audit with an application

Steve,
I updated my kernel and that seemed to fix the problem.

Thanks,

Frank

Quoted 23 lines · Steve Grubb

Quoted 4 lines · On Saturday 17 March 2007 17:34:57 geckiv wrote:
FAILURE: errno = 22
Error writing audit file: Invalid argument
I bet this is the problem. ^^^^ EINVAL. That can be bad arguments or sometimes a permission problem from selinux.
Quoted 3 lines
Error writing audit: Illegal seek
This was probably a changed errno from perror.
-Steve