I have a question about the SOCKADDR token in a SYSCALL record (syscall 42 --
connect())
Most of my records begin with one of the two values:
saddr=0200
saddr=0100
Followed by the port & IPv4 address or the file path.
QUESTION 1: The file path appears to be NULL terminated. Is this correct?
QUESTION 2: There is often additional characters after the 00 termination (and
IP address). Is this just garbage that should be ignored?
QUESTION 3: Sometimes the first byte in a file path is 00 termination (e.g.,
saddr=0100002F…). Does this mean the string is empty and the content following
it is garbage? Or is there a bug that accidentally prepends the 00 to the front
of the saddr sequence?
Here is an example:
————————
type=SYSCALL msg=audit(1397089029.264:7407): arch=c000003e syscall=42
success=yes exit=0 a0=3 a1=7fff3a7fdf70 a2=16 a3=7fff3a7fdd20 items=0 ppid=805
pid=1064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 ses=4294967295 tty=(none) comm="initctl" exe="/sbin/initctl" key=(null)
type=SOCKADDR msg=audit(1397089029.264:7407):
saddr=0100002F636F6D2F7562756E74752F75707374617274
————————
If I assume the first 00 is a bug, the string decodes to
/com/ubuntu/upstart
Thanks,
Todd
PS. uname -r gives 3.13.0-24-generic (though, I think I collected these logs
before the last software update)
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
