[PATCH] Added prose to describe audit messages.

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Jul 30 17:37:02 UTC 2012


Looks nice and illustrates well what's in an audit entry -- ACK.




On 07/30/2012 11:02 AM, Willy Santos wrote:
> ---
>  RHEL6/input/system/auditing.xml |   74 ++++++++++++++++++++++++++++++++++++++-
>  1 files changed, 73 insertions(+), 1 deletions(-)
> 
> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
> index acfee4e..11e1ad6 100644
> --- a/RHEL6/input/system/auditing.xml
> +++ b/RHEL6/input/system/auditing.xml
> @@ -53,7 +53,79 @@ data in total, and refuses to write entries when the disk is too
>  full. This minimizes the risk of audit data filling its partition
>  and impacting other services. This also minimizes the risk of the audit
>  daemon temporarily disabling the system if it cannot write audit log (which
> -it can be configured to do). 
> +it can be configured to do).
> +<br /><br />
> +The following is an example of a typical "raw" audit message and a breakdown of
> +what the most important fields mean. In this example the message is SELinux
> +related and reports an AVC denial (and the associated system call) that occurred
> +when the Apache HTTP Server (running in the <tt>httpd_t</tt> domain)
> +attempted to access the <tt>/var/www/html/file1</tt> file (labeled with the
> +<tt>samba_share_t</tt> type):
> +<pre>type=AVC msg=audit(1226874073.147:96): avc:  denied  { getattr } for pid=2465 comm="httpd"
> +path="/var/www/html/file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0 
> +tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file
> +
> +type=SYSCALL msg=audit(1226874073.147:96): arch=40000003 syscall=196 success=no exit=-13 
> +a0=b98df198 a1=bfec85dc a2=54dff4 a3=2008171 items=0 ppid=2463 pid=2465 auid=502 uid=48
> +gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=6 comm="httpd"
> +exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
> +</pre>
> +<ul>
> +<li><tt>msg=audit(1226874073.147:96)</tt>
> +<ul><li>The number in parentheses is the unformatted current time (Epoch time) or
> +time stamp for the event. It can be converted to standard time by using the
> +<tt>date</tt> command:
> +<pre># date -d @1226874073.147
> +<i>Sun Nov 16 17:21:13 EST 2008</i>
> +</pre>
> +</li></ul>
> +</li>
> +<li><tt>{ getattr }</tt>
> +<ul><li>The item in braces indicates the permission that was denied. <tt>getattr</tt>
> +indicates the source process was trying to read the target file's status information.
> +This occurs before reading files. This action is denied due to the file being
> +accessed having the wrong label. Commonly seen permissions include <tt>getattr</tt>,
> +<tt>read</tt>, and <tt>write</tt>.</li></ul>
> +</li>
> +<li><tt>comm="httpd"</tt>
> +<ul><li>The executable that launched the process. The full path of the executable is
> +found in the <tt>exe=</tt> section of the system call (<tt>SYSCALL</tt>) message,
> +which in this case, is <tt>exe="/usr/sbin/httpd"</tt>.
> +</li></ul>
> +</li>
> +<li><tt>path="/var/www/html/file1"</tt>
> +<ul><li>The path to the object (target) the process attempted to access.
> +</li></ul>
> +</li>
> +<li><tt>scontext="unconfined_u:system_r:httpd_t:s0"</tt>
> +<ul><li>The SELinux context of the process that attempted the denied action. In
> +this case, it is the SELinux context of the Apache HTTP Server, which is running
> +in the <tt>httpd_t</tt> domain.
> +</li></ul>
> +</li>
> +<li><tt>tcontext="unconfined_u:object_r:samba_share_t:s0"</tt>
> +<ul><li>The SELinux context of the object (target) the process attempted to access.
> +In this case, it is the SELinux context of <tt>file1</tt>. Note: the <tt>samba_share_t</tt>
> +type is not accessible to processes running in the <tt>httpd_t</tt> domain.</li>
> +<li>In certain situations, the <tt>tcontext</tt> may match the <tt>scontext</tt>,
> +for example, when a process attempts to execute a system service that will change
> +characteristics of that running process, such as the user ID. Also, the <tt>tcontext</tt>
> +may match the <tt>scontext</tt> when a process tries to use more resources (such as
> +memory) than normal limits allow, resulting in a security check to see if that
> +process is allowed to break those limits.
> +</li></ul>
> +</li>
> +<li> From the system call (<tt>SYSCALL</tt>) message, two items are of interest:
> +<ul><li><tt>success=no</tt>: indicates whether the denial (AVC) was enforced or not.
> +<tt>success=no</tt> indicates the system call was not successful (SELinux denied
> +access). <tt>success=yes</tt> indicates the system call was successful - this can
> +be seen for permissive domains or unconfined domains, such as <tt>initrc_t</tt>
> +and <tt>kernel_t</tt>.
> +</li>
> +<li><tt>exe="/usr/sbin/httpd"</tt>: the full path to the executable that launched
> +the process, which in this case, is <tt>exe="/usr/sbin/httpd"</tt>.
> +</li></ul>
> +</li></ul>
>  </description>
>  <ref disa="120,135,166,1338,1339,157" />
>  

-- 
___________________________
Jeffrey Blank
410-854-8675
Technology and Systems Analysis / Network Components
NSA Information Assurance


More information about the scap-security-guide mailing list