On 2018-11-15 23:45, Steve Grubb wrote: > On Thu, 15 Nov 2018 08:23:46 -0500 > Richard Guy Briggs <[email protected]> wrote: > > > > I thought that the prime audit connection requires a capability > > > check to ensure a process without proper privilege does not replace > > > the audit daemon...since that's now possible. Are there privilege > > > checks for who can connect to the audit socket? Shouldn't that > > > process also have CAP_AUDIT_READ since that is what it will be > > > doing? > > > > The only cap that will let a daemon be checked for replacement is > > CAP_AUDIT_CONTROL. CAP_AUDIT_READ is only used for the unreliable > > reception of multicast audit log records. > > > > The unicast socket is gated by CAP_AUDIT_CONTROL and CAP_AUDIT_WRITE. > > The multicast read-only unreliable socket is gated by > > CAP_AUDIT_READ. > > My understanding was that CAP_AUDIT_READ was required by everything > that read, including unicast. That is why it checks that capability > CAP_AUDIT_READ. Shouldn't everything reading need that capability?
No. CONTROL already did that. READ *was* only ever and still is only for the bind function of the multicast socket. Full stop. > -Steve - RGB -- Richard Guy Briggs <[email protected]> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
