RHEA-2009:1303 - Product Enhancement Advisory

Topic

Updated audit packages, which includes TTY audit and remote log aggregation
updates among other enhancements, are now available.

Description

The audit packages contain user space utilities for storing and searching
the audit records generated by the audit subsystem in the Linux 2.6 kernel.

These updated packages upgrade the auditd daemon and its utilities to the
newer upstream version 1.7.13 (BZ#483608), which provides the following
enhancements and bug fixes over the previous version:

• the user-space audit tools use ausearch to search audit records. Ausearch

does not contain logic to handle event-linked lists and previously, could
not find records if they were out of chronological order. The logic to link
these lists together and evaluate whether the list is complete is now
available in the auparse library. Ausearch now uses auparse to handle these
lists so that it can find records even when they are out of order.
(BZ#235398)

• the manual page for ausyscall did not document use of the "--exact" option.

A description of "--exact" is now included. (BZ#471383)

• due to a logic error, the "local_port = any" option for the audisp-remote

plugin did not work as described in the manual page. When executed with this
option, the plugin would display the error "Value any should only be numbers"
and terminate. With the error corrected, the plugin works as documented.
(BZ#474466)

• previously, audisp would read not only its configuration file (in

/etc/audisp/plugins.d/) but any files with names simlar to its configuration
file found in the same directory, for example, backups of the configuration
file. As a result, if a plugin were listed in more than one configuration
file, it would be activated multiple times. audisp now reads only its
configuration file and therefore avoids activating multiple copies of plugins.
(BZ#476189)

• previously, TTY audit results were reported in ausearch in their raw

hexadecimal form. This format was not easily readable by humans, so
ausearch now converts the hexadecimal strings and presents them as their
corresponding keystrokes. Note that the "--tty" option has now been added
to aureport to provide a convenient way of accessing the TTY audit report.
(BZ#483086)

• previously, when setting the output log format to "NOLOG", audit events

would be added to the internal message queue but not removed from the queue
when written to the dispatchers. The queue would therefore grow to consume
available memory. Audit events are now removed from the internal queue to
avoid this memory leak. (BZ#487237)

• due to a logic error, auditctl was not correctly parsing options that

included non-numeric characters. For example, the "-F a0!=-1" option would
result in an error saying "-F value should be number for a0!=-1". With the
error corrected, auditctl parses this rule correctly. (BZ#497542)

Other issues corrected in the rebase include:

• remote logging is a technology preview item and as such had some bugs.

Robustness of this facility was improved.

• on busy systems, pam had problems communicating with the audit

system, which resulted in a timeout and being denied access to the system.
We now loop a few times when checking for the event ACK.

• On biarch system, a warning is emitted if audit rules don't cover both 64

& 32 bit syscalls of the same name.

• Fix regression where msgtype couldn't be used for a range of types.
• New aulast program helps analyse login session information.
• If log rotation fails, auditd now leaves the old log writable.
• A tcp_wrappers config option was added to auditd for remote logging.
• Fix problem where negative uids in audit rules on 32 bit systems resulted

in the wrong uid and therefore incorrect event logging.

Users of audit are advised to upgrade to these updated packages, which add
these enhancements and bug fixes.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 235398 - LSPP: ausearch does not correctly find out of order records
• BZ - 471383 - Missing description of option '--exact' in manual page for ausyscall
• BZ - 476189 - audispd activates the same plugin several times
• BZ - 483086 - RFE: fix tty audit reporting
• BZ - 483608 - audit updates for 5.4
• BZ - 497542 - auditctl parsing error for arg0-3 fields

CVEs

(none)

References

(none)