[PATCH] Added prose to describe audit messages.

Willy Santos wsantos at redhat.com
Mon Jul 30 15:02:32 UTC 2012


---
 RHEL6/input/system/auditing.xml |   74 ++++++++++++++++++++++++++++++++++++++-
 1 files changed, 73 insertions(+), 1 deletions(-)

diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index acfee4e..11e1ad6 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -53,7 +53,79 @@ data in total, and refuses to write entries when the disk is too
 full. This minimizes the risk of audit data filling its partition
 and impacting other services. This also minimizes the risk of the audit
 daemon temporarily disabling the system if it cannot write audit log (which
-it can be configured to do). 
+it can be configured to do).
+<br /><br />
+The following is an example of a typical "raw" audit message and a breakdown of
+what the most important fields mean. In this example the message is SELinux
+related and reports an AVC denial (and the associated system call) that occurred
+when the Apache HTTP Server (running in the <tt>httpd_t</tt> domain)
+attempted to access the <tt>/var/www/html/file1</tt> file (labeled with the
+<tt>samba_share_t</tt> type):
+<pre>type=AVC msg=audit(1226874073.147:96): avc:  denied  { getattr } for pid=2465 comm="httpd"
+path="/var/www/html/file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0 
+tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file
+
+type=SYSCALL msg=audit(1226874073.147:96): arch=40000003 syscall=196 success=no exit=-13 
+a0=b98df198 a1=bfec85dc a2=54dff4 a3=2008171 items=0 ppid=2463 pid=2465 auid=502 uid=48
+gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=6 comm="httpd"
+exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
+</pre>
+<ul>
+<li><tt>msg=audit(1226874073.147:96)</tt>
+<ul><li>The number in parentheses is the unformatted current time (Epoch time) or
+time stamp for the event. It can be converted to standard time by using the
+<tt>date</tt> command:
+<pre># date -d @1226874073.147
+<i>Sun Nov 16 17:21:13 EST 2008</i>
+</pre>
+</li></ul>
+</li>
+<li><tt>{ getattr }</tt>
+<ul><li>The item in braces indicates the permission that was denied. <tt>getattr</tt>
+indicates the source process was trying to read the target file's status information.
+This occurs before reading files. This action is denied due to the file being
+accessed having the wrong label. Commonly seen permissions include <tt>getattr</tt>,
+<tt>read</tt>, and <tt>write</tt>.</li></ul>
+</li>
+<li><tt>comm="httpd"</tt>
+<ul><li>The executable that launched the process. The full path of the executable is
+found in the <tt>exe=</tt> section of the system call (<tt>SYSCALL</tt>) message,
+which in this case, is <tt>exe="/usr/sbin/httpd"</tt>.
+</li></ul>
+</li>
+<li><tt>path="/var/www/html/file1"</tt>
+<ul><li>The path to the object (target) the process attempted to access.
+</li></ul>
+</li>
+<li><tt>scontext="unconfined_u:system_r:httpd_t:s0"</tt>
+<ul><li>The SELinux context of the process that attempted the denied action. In
+this case, it is the SELinux context of the Apache HTTP Server, which is running
+in the <tt>httpd_t</tt> domain.
+</li></ul>
+</li>
+<li><tt>tcontext="unconfined_u:object_r:samba_share_t:s0"</tt>
+<ul><li>The SELinux context of the object (target) the process attempted to access.
+In this case, it is the SELinux context of <tt>file1</tt>. Note: the <tt>samba_share_t</tt>
+type is not accessible to processes running in the <tt>httpd_t</tt> domain.</li>
+<li>In certain situations, the <tt>tcontext</tt> may match the <tt>scontext</tt>,
+for example, when a process attempts to execute a system service that will change
+characteristics of that running process, such as the user ID. Also, the <tt>tcontext</tt>
+may match the <tt>scontext</tt> when a process tries to use more resources (such as
+memory) than normal limits allow, resulting in a security check to see if that
+process is allowed to break those limits.
+</li></ul>
+</li>
+<li> From the system call (<tt>SYSCALL</tt>) message, two items are of interest:
+<ul><li><tt>success=no</tt>: indicates whether the denial (AVC) was enforced or not.
+<tt>success=no</tt> indicates the system call was not successful (SELinux denied
+access). <tt>success=yes</tt> indicates the system call was successful - this can
+be seen for permissive domains or unconfined domains, such as <tt>initrc_t</tt>
+and <tt>kernel_t</tt>.
+</li>
+<li><tt>exe="/usr/sbin/httpd"</tt>: the full path to the executable that launched
+the process, which in this case, is <tt>exe="/usr/sbin/httpd"</tt>.
+</li></ul>
+</li></ul>
 </description>
 <ref disa="120,135,166,1338,1339,157" />
 
-- 
1.7.7.6



More information about the scap-security-guide mailing list