Bug#759604: Any problem with making auditd log readable by the adm group?
Hi,
in Debian, the convention for many log files is to make them readable by members of the adm group. We're considering doing the same for the auditd logs, in order to make apparmor-notify work out-of-the-box.
The maintainer of auditd in Debian would like to know what's your take on it. What kind of problem could be created if we did that?
Cheers,
Re: Any problem with making auditd log readable by the adm group?
Quoted 6 lines · intrigeri
in Debian, the convention for many log files is to make them readable by members of the adm group. We're considering doing the same for the auditd logs, in order to make apparmor-notify work out-of-the-box.
The maintainer of auditd in Debian would like to know what's your take on it. What kind of problem could be created if we did that?
I can't think of any problems. Just set the log_group = adm in auditd.conf and fixup the packaging to have that as the group owner. Auditd should create the logs with 0640 permissions.
-Steve
Steve Grubb wrote (09 May 2016 19:33:16 GMT) :
Quoted 9 lines · intrigeri
Quoted 6 lines
in Debian, the convention for many log files is to make them readable by members of the adm group. We're considering doing the same for the auditd logs, in order to make apparmor-notify work out-of-the-box.
The maintainer of auditd in Debian would like to know what's your take on it. What kind of problem could be created if we did that?
I can't think of any problems.
Thanks for your input!
Cheers,
Quoted 1 line · intrigeri
Hi,
Hey,
Quoted 3 lines
in Debian, the convention for many log files is to make them readable by members of the adm group. We're considering doing the same for the auditd logs, in order to make apparmor-notify work out-of-the-box.
Shouldn't apparmor-notify use the audispd to get the events instead of parsing directly the logs?
I'm not objecting changing the permissions in debian, but I'm wondering if it shouldn't be better to do it like that, I think that the setroubleshoot (a SELinux troubleshooting service used in RHEL/Fedora) is doing it like that.
Cheers,
Laurent Bigonville
Quoted 11 lines · Laurent Bigonville
Quoted 1 line · intrigeri
Hi,
Hey,
Quoted 3 lines
in Debian, the convention for many log files is to make them readable by members of the adm group. We're considering doing the same for the auditd logs, in order to make apparmor-notify work out-of-the-box.
Shouldn't apparmor-notify use the audispd to get the events instead of parsing directly the logs?
If this is a realtime event analysis tool, then yes. (The original question I thought was if adding the adm group to let admins search audit logs would hurt anything.) There are two ways that you can get the events. One way is to enable the af_unix plugin and read off of the unix socket. The other way is to make a plugin for which there is skeleton code here:
https://github.com/linux-audit/audit-userspace/tree/master/contrib/plugin
Quoted 4 lines
I'm not objecting changing the permissions in debian, but I'm wondering if it shouldn't be better to do it like that, I think that the setroubleshoot (a SELinux troubleshooting service used in RHEL/Fedora) is doing it like that.
That is correct.
-Steve