RHBA-2011:0653 - Bug Fix Advisory

Topic

Updated audit packages that fix bugs and provide enhancements are now available
for Red Hat Enterprise Linux 6.

Description

The audit packages contain the user space utilities for storing and searching the audit records which have been generated by the audit subsystem in the Linux 2.6 kernel.

This update fixes the following bugs:

• System processes — that is processes with an audit id (auid) of -1 — are logged by the audit subsystem. However, if the ausearch utility was used to locate events where the auid was -1, it would display all events. In this update, under these circumstances, ausearch only returns events with an auid of -1. (BZ#670938)
• A value of 'syslog' for the 'disk_error_action' parameter in 'auditd.conf' instructs auditd to issue a warning to syslog if an error is encountered when writing audit events to disk. If 'disk_error_action' was set to 'syslog', auditd always attempted to exec() a child process. Consequently, if a disk error was encountered (ie. a disk full error), auditd would attempt to exec() a null child process, and logging would not resume after the disk error was reported to syslog. In this update the child process is not called when the 'syslog' option is used, and logging continues as expected. (BZ#688664)
• Previously if an audispd plug-in was restarted, the plug-in was not marked as active. Consequently, the remote logging plug-in (audisp-remote) was unable to bind to a privileged port on reconnect because all privileges had been dropped. In these updated packages, audispd plug-ins are marked as active after being restarted, and the audisp-remote plug-in functions as expected. (BZ#695605)
• Previously, the "autrace -r" command on the IBM System z architecture attempted to audit network syscalls not available on IBM System z. Consequently, an error similar to the following might have been returned:

Error inserting audit rule for pid=13163

With this update, "autrace -r" is now aware of system calls not available on this architecture, which resolves this issue. (BZ#697463)

• When an ignore directive was included in an audit.rules configuration file, the auditctl utility became unresponsive when attempting to load those rules. With this update, the issue is resolved. (BZ#640948)
• Previously, the audit_encode_nv_string() function was not checking if the memory allocation (malloc) it was performing succeeded. Consequently, if the malloc operation encountered an out of memory (OOM) error, audit_encode_nv_string() crashed attempting to reference a NULL pointer. With this update, audit_encode_nv_string() checks if the malloc is successful, which resolves this issue. (BZ#647128)
• Previously, the man page for the "audit_encode_nv_string" function incorrectly documented the return value type as an "int". The man page for "audit_encode_nv_string" now correctly displays return value type for the "audit_encode_nv_string" function as a "char *" (BZ#647131)

Additionally, the audit packages are updated (rebased) to the upstream version 2.1-1. (BZ#584981) This rebase provides the following bugfix:

• autrace now uses the correct syscalls on i386 systems

In addition, the rebase provides the following enhancements:

• Added support for new event types related to virtualization, netfilter, the mmap syscall, key based authentication, and cryptographic session establishment.
• Updated syscall tables for the 2.6.37 kernel.
• Updated sample rules for new syscalls and packages.
• The overflow_action configuration item was added to

audisp-remote to allow configurable actions for remote logging queue overflows.

• A new option in the audisp-syslog plug-in to send syslog audit events to local[0-7]

All audit users are advised to upgrade to these updated packages, which resolve these issues and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 640948 - inodes display incorrectly when listing rules
• BZ - 647128 - audit_encode_nv_string() will crash on NULL pointer on OOM
• BZ - 647131 - Man page for audit_encode_nv_string() is incorrect
• BZ - 670938 - searching on auid = -1 results in all events
• BZ - 688664 - Auditd disk_error_action tries to execute a program when the SYSLOG action was chosen
• BZ - 695605 - audisp-remote calls bind() incorrectly
• BZ - 697463 - Broken autrace -r on s390x
• BZ - 700098 - aureport --tty segfaults

CVEs

(none)

References

(none)