On Mon, 05 May 2014 15:11:56 -0700 [email protected] wrote: > I have a question about the SOCKADDR token in a SYSCALL record > (syscall 42 -- connect()) > > Most of my records begin with one of the two values: > saddr=0200 > saddr=0100 > > Followed by the port & IPv4 address or the file path.
saddr is a hex encoded blob that is a struct sockaddr. > QUESTION 1: The file path appears to be NULL terminated. Is this > correct? Its a socket address structure. It may or may not be null terminated depending on the socket type. > QUESTION 2: There is often additional characters after the 00 > termination (and IP address). Is this just garbage that should be > ignored? Its other fields in struct sockaddr. > QUESTION 3: Sometimes the first byte in a file path is 00 termination > (e.g., saddr=0100002F…). Does this mean the string is empty and the > content following it is garbage? Or is there a bug that accidentally > prepends the 00 to the front of the saddr sequence? That would be an abstract af_unix socket. -Steve > Here is an example: > > ———————— > type=SYSCALL msg=audit(1397089029.264:7407): arch=c000003e syscall=42 > success=yes exit=0 a0=3 a1=7fff3a7fdf70 a2=16 a3=7fff3a7fdd20 items=0 > ppid=805 pid=1064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 > egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="initctl" > exe="/sbin/initctl" key=(null) > > type=SOCKADDR msg=audit(1397089029.264:7407): > saddr=0100002F636F6D2F7562756E74752F75707374617274 ———————— > > If I assume the first 00 is a bug, the string decodes to > > /com/ubuntu/upstart > > Thanks, > > Todd > > PS. uname -r gives 3.13.0-24-generic (though, I think I collected > these logs before the last software update) > > > -- > Linux-audit mailing list > [email protected] > https://www.redhat.com/mailman/listinfo/linux-audit -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
