RHBA-2014:1515 - Bug Fix Advisory

Topic

Updated audit packages that fix several bugs and add various enhancements are
now available for Red Hat Enterprise Linux 6.

Description

The audit packages contain the userspace utilities for storing and searching
the audit records which have been generated by the audit subsystem in the Linux
2.6 kernel.

The audit packages have been upgraded to upstream version 2.3.7, which provides
a number of bug fixes and enhancements over the previous version, among which
the following are especially note-worthy:

• The interpretation of the "ausearch -i" command, alternatively

"ausearch --interpret", has been improved.

• New event types are supported by the audit packages.
• Remote logging bugs have been fixed.
• The ausearch matching has been improved.
• The augenrules utility support has been added to the audit packages.
• Management of audispd plugins has been completely reworked.
• The updated ausearch and aureport utilities can now produce reports from logs

not included in the configured audit log directory by specifying the directory
containing
the logs on the command line.

• The auditctl list rules command (the -l option) now outputs rules from the

kernel in a new format which matches the formatting accepted to be loaded into
the kernel. (BZ#1065067)

This update also fixes the following bug:

• Previously, the audisp-remote plugin did not connect to the remote server

after a transient "critical" network error. The underlying source code has been
patched, and audisp-remote now connects to the remote server as intended.
(BZ#1028635)

In addition, this update adds the following enhancements:

• With this update, audit rules can be built from a directory of rule files.

Rule files can be stored in the /etc/audit/rules.d/ directory based on what
packages are installed. When rules need to be loaded into the kernel, they are
now assembled into one master file by the augenrules utility and then loaded.
(BZ#96723)

• This update adds a new command line option, --checkpoint. When invoked, the
• -checkpoint option causes the ausearch utility to report only new complete

events on successive executions. This option is especially useful for running
periodic reports that display the updates since the last report.
(BZ#967240)

Users of audit are advised to upgrade to these updated packages, which fix these
bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 810749 - audit allows tcp_max_per_addr + 1 connections
• BZ - 869555 - ausearch -i does not interpret execve arguments when aN_len=nbytes is encountered
• BZ - 922508 - [RFE] confusing aulast records for bad logins
• BZ - 950158 - man page is unclear as to how num_logs affects keep_logs setting
• BZ - 967238 - FutureFeature: Audit rules are built from a directory of rule files
• BZ - 967240 - FutureFeature: ausearch to checkpoint its output to only report new events on successive executions
• BZ - 1011052 - Missing text in auditd.conf man page
• BZ - 1028635 - audisp-remote will not reconnect to remote server after a transient "critical" network error
• BZ - 1029981 - ausearch help typo for "-x" option
• BZ - 1049916 - ausearch issues found by ausearch-test
• BZ - 1053424 - Error in auparse-defs.h (audit-libs-devel package)
• BZ - 1065067 - Audit package rebase to 2.3.7
• BZ - 1071580 - audispd config file parser fails on long input
• BZ - 1111448 - Segmentation fault while run auvirt --all-events sometimes
• BZ - 1120286 - ausearch -i does not display commas between categories

CVEs

(none)

References

(none)