Steve,
I never heard of dbus before. Is there an example how it keeps it's
CAP_AUDIT_WRITE and changes uids? Is this just using setuid() some how?
Thanks,
Frank
Steve Grubb wrote:
On Saturday 17 March 2007 17:34:57 geckiv wrote:
Thanks for the reply. I must have something wrong with my system as I
can't get it to work even running it as root. I get an error of:
FAILURE: errno = 22
Error writing audit file: Invalid argument
Error writing audit: Illegal seek
This does sound wrong. Maybe strace would shed some light on how its going
wrong? What kernel are you using?
Also how do I set auditd to allow other process(s) running not as root
to write to the netlink/kernel ( i.e. set CAP_AUDIT_WRITE)?
You can't. The audit system is designed to be high integrity meaning only
trusted apps or processes that run as root or started as root but dropped
privileges keeping CAP_AUDIT_WRITE. The audit event is written to the kernel,
not auditd (meaning the kernel must be compiled with syscall audit support at
a minimum). The kernel may decide to give the event to auditd.
I could not find any info on this. Also where do I find these trusted app
examples?
dbus, nscd, passwd, shadow-utils, pam, ...
Is this something I down loa the src of Linux and look for?
No, dbus is an example of a program that keeps CAP_AUDIT_WRITE after starting
as root but changes uids. passwd is setuid root. pam runs as part of
applications that stay root.
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
