RHBA-2012:0929 - Bug Fix Advisory

Topic

Updated audit packages that fix multiple bugs and add several enhancements are
now available for Red Hat Enterprise Linux 6.

Description

The audit packages contain the user space utilities for storing and searching
the audit records which have been generated by the audit subsystem in the Linux
2.6 kernel.

The audit packages have been upgraded to upstream version 2.2, which provides a
number of bug fixes and enhancements over the previous version. The version 2.2
packages introduce the following enhancements:

• The "auditctl" command now allows shell-escaped file names for better handling

of file names with spaces in them.

• There is a new utility, auvirt, that extracts a report about the

virtualization events.

• The auditd.conf configuration option, "tcp_max_per_addr", now allows up to

1024 concurrent connections from the same IP address. While this is not
recommended for normal use, it helps in situations where a number of client
systems are behind a NAT, which causes them to appear to have the same IP
address.

This update also fixes the following bugs:

• Previously, not enough information was parsed to determine whether audit

records are part of the same event if the server's node name was longer than
approximately 80 characters. With this update, the problem has been fixed.
(BZ#803349)

• This update fixes a typo in the audit.rules(7) man page. (BZ#797848)

Also, this update adds the following enhancements:

• Prior to this update, if the audit rules had a typo or the command was not

supported by the Linux kernel, either an error was triggered and you were able
to stop processing the rules or, as the other option, you were able to ignore
any errors in which case it completed everything it could but returned success.
This update introduces the "-c" option to auditctl which works like the ignore
option, but instead of returning success, the "-c" option returns failure if any
rule triggers an error. Note that like the ignore option, the "-c" option
continues to process all audit rules. (BZ#658630)

• This release adds support for a new kernel auditing feature that allows for

inter-field comparisons. For each audit event, the Linux kernel collects
information about what is causing the event. Now, you can use the "-C" option to
compare: "auid", "uid", "euid", "suid", "fsuid", or "obj_uid"; and "gid",
"egid", "sgid", "fsgid", or "obj_gid". The two groups cannot be mixed.
Comparisons can use either the equal or not equal operators.
Note that for this enhancement to work, the system must boot the Linux
2.6.32-244 kernel or later. (BZ#766920)

All audit users are advised to upgrade to these updated packages, which fix
these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 658630 - [RFE] include "check but load" option for audit
• BZ - 797848 - audit.rules contains a typo error
• BZ - 803349 - allocate extra space for node names

CVEs

(none)

References

(none)