kernel-packages team mailing list archive

[Tyler Hicks <tyhicks@xxxxxxxxxxxxx>]

I built Saucy's audit package for Precise and ran it under the -lts-
saucy kernel. When running the auditctl command in the bug description,
it emitted the following warning:

  Warning - entry rules deprecated, changing to exit rule

Starting with kernel version 3.3, the audit kernel code refuses
entry,always rules. Starting with audit version 2.0, auditctl converts
entry,always rules to exit,always rules.

The fix seems to be to backport upstream audit commits 300, 301, and 307
to Precise's audit package to make auditctl convert entry,always rules
to exit,always.

** Changed in: audit (Ubuntu)
   Importance: Undecided => Medium

** Changed in: audit (Ubuntu)
       Status: Confirmed => Triaged

** Changed in: audit (Ubuntu)
     Assignee: (unassigned) => Tyler Hicks (tyhicks)

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1158500

Title:
  auditd fails to add rules when used in precise with -lts-quantal
  kernel

Status in “audit” package in Ubuntu:
  Triaged
Status in “linux” package in Ubuntu:
  Invalid

Bug description:
  auditctl fails to add rules when run with the -lts-quantal kernel

  Eample:
  # auditctl -l
  No rules
  # auditctl -a entry,always -F arch=b64 -S execve -k exec
  Error sending add rule data request (Invalid argument)
  #

  Looks like the syscall table needs updating, it works with the 3.2.0
  kernel.

  Tagging this as a security vulnerability because it fails fairly
  quietly and may lead to high security systems not having required
  auditing (like PCI compliant systems), I only noticed by looking in
  /var/log/boot.log.

  Description:	Ubuntu 12.04.2 LTS
  Release:	12.04

  ii  auditd                             1.7.18-1ubuntu1                    User space tools for security auditing
  ii  linux-image-generic-lts-quantal    3.5.0.26.33                        Generic Linux kernel image

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/audit/+bug/1158500/+subscriptions