-
Notifications
You must be signed in to change notification settings - Fork 18
Remove rules which don't work on Ubuntu 12.04.3 #1
Conversation
``` ssharpe@ qa-jump-1:~$ sudo service auditd restart Restarting audit daemon auditd Error sending add rule data request (Invalid argument) There was an error in line 33 of /etc/audit/audit.rules [ OK ] ``` https://bugs.launchpad.net/ubuntu/+source/audit/+bug/1158500 This seems to imply that the syscall table is out of sync between Precise and the kernel installed by Ubuntu with 12.04.3 The syscalls are provided by the linux-libc-dev package: http://packages.ubuntu.com/search?keywords=linux-libc-dev There is no installable package for Precise I can find which has a matching syscall table to the lts-raring kernel. Auditing we lose: - creation of device files - mounting and unmounting devices - changing the time - changing the hostname - running commands as root - failures to access critical elements
Attached commit removes the audit-rules which don't work on Ubuntu 12.04.3 Whether this is merged is up for discussion, but I thought it would be helpful as a form of documentation. Auditing we lose:
|
NB: Don't forget when merging to tag and push a new version to the forge! |
if we're making this 12.04.3-specific we should be loud in the README about this fact. but yes, having it not work on 12.04.3 is bad and wrong and should be fixed. |
We tried rebuilding the Raring packages for auditd against precise with the raring kernel:
With those packages and this config, the audit system works. That seems like a sledgehammer solution to the problem though.
|
-S options seems to work for me in a vagrant box on 12.04.4... |
Is that a typo? - 12.04.4 wasn't supposed to be released until Feb 6th. https://wiki.ubuntu.com/PrecisePangolin/ReleaseSchedule |
it's what I got when I used http://files.vagrantup.com/precise64.box |
Curiouser and Curiouser - what's the kernel version? |
So I unpacked that box and it's got linux-image-3.2.0-30 installed. That indicates that it was probably built by taking 12.04.2 media or earlier and then running |
ah ok thanks. I tried another box with 3.8.0-29 and got the error. :( |
so the latest comment on the launchpad bug suggests that the problem is that Just tried on my XPS13 running 12.04.4 with kernel 3.8.0-35-generic, and entry rules get rejected but exit rules seem ok. Here's an example of the mknod rule firing:
don't understand the syscall number in the above output, as far as I can tell 133 == fchdir, not mknod, but it seems to be capturing the right event otherwise. |
is this still a bug. do we still care given improvements to the module since? |
I'm with Phil - I was wrong to claim this is a bug (although the package might have handled this better). |
https://bugs.launchpad.net/ubuntu/+source/audit/+bug/1158500
This seems to imply that the syscall table is out of sync between Precise and the kernel installed by Ubuntu with 12.04.3
The syscalls are provided by the linux-libc-dev package:
http://packages.ubuntu.com/search?keywords=linux-libc-dev
There is no installable package for Precise I can find which has a matching syscall table to the lts-raring kernel. ARRGGHHH.