RHBA-2015:0479 - Bug Fix Advisory

Topic

Updated audit packages that fix several bugs and add various enhancements are
now available for Red Hat Enterprise Linux 7.

Description

The audit packages contain the user-space utilities for storing and searching
the audit records which have been generated by the audit subsystem in the Linux
2.6 kernel.

The audit packages have been upgraded to upstream version 2.4.1, which provides
a number of bug fixes and enhancements over the previous version. (BZ#1142989)

This update also fixes the following bugs:

• The "--bad" option of the "aulast" command reports unsuccessful logins.

Previously, the output of the "aulast --bad --proof" command could be confusing.
The command returned certain non-existing audit events, the "still logged in"
message instead of the correct time of the unsuccessful login, and sometimes
also two records per one unsuccessful login. With this update, the output has
been modified to address the aforementioned bugs. (BZ#975796)

• Examples in the auditctl(8), audit.rules(7), and several other manual pages

referred to the open() system call, which had been deprecated on certain
architectures. The manual pages have been modified to refer to the newer system
calls instead of open() where required. (BZ#1088593)

• Previously, the output of the "ausearch" command could be truncated and did

not provide all information about the SELinux context. This update provides a
patch to fix this bug, and "ausearch" now returns the correct output as
expected. (BZ#1104973)

• Due to a bug in the get_line() function, the audispd utility failed to parse

lines longer then 128 characters. The underlying source code has been modified,
and audispd no longer fails in the described situation. (BZ#1105150)

In addition, this update adds the following enhancements:

• The AUDIT_SECCOMP event blocks system calls based on per application policy

and records the system call that is being blocked. Each architecture or platform
has its system calls numbered differently. The "arch=" field has been added to
AUDIT_SECCOMP to enable decoding the system call number. To address this,
several changes have been made to audit utilities. The ausearch utility can now
interpret the number of the SECCOMP system call to its name and search for the
call. Also, the aureport utility is now able to collect the SECCOMP system call
in its report. (BZ#1073063)

• With this update, the audit subsystem is able to set the "loginuid" value

immutable. (BZ#1087849)

Users of audit are advised to upgrade to these updated packages, which fix these
bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64

Fixes

• BZ - 975796 - [RFE] confusing aulast records for bad logins
• BZ - 1073063 - AUDIT_SECCOMP events syscall field is not interpretted
• BZ - 1104973 - auparse seems to be truncating path audit message selinux context after first category
• BZ - 1105150 - audispd config file parser fails on long input
• BZ - 1155221 - adjust fstatat naming to match kernel uapi
• BZ - 1180675 - ppc64le: rules with "-F arch=ppc64le" fail to load
• BZ - 1182174 - Drop golang bindings from audit

CVEs

(none)

References

(none)