Date: Sat, 14 Jul 2007 16:45:14 +0100 (BST) From: Robert Watson <rwatson@FreeBSD.org> To: Alex Samorukov <ml@os2.kiev.ua> Cc: freebsd-security@freebsd.org Subject: Re: OpenBSM questions Message-ID: <20070714164146.Q80803@fledge.watson.org> In-Reply-To: <46985815.3060308@os2.kiev.ua> References: <46985815.3060308@os2.kiev.ua>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, 14 Jul 2007, Alex Samorukov wrote: > I have some issues with OpenBSM which i cannot resolve, so i decided to ask > there. > > 1) I found some bugs in the auditreduce utility and created patch for it - > http://www.freebsd.org/cgi/query-pr.cgi?pr=114534. Please, someone from > freebsd team - take it, i think its better to fix this before next release. I was not aware of this PR, thanks for pointing it out. In the future, if no one picks up an audit-related PR, feel free to send e-mail to trustedbsd-audit@TrustedBSD.org and/or directly to me. I've grabbed ownership of this PR and will apply the changes to OpenBSM, hopefully today. > 2) I found that when i`m using XDM as login manager with OpenBSM, all my > audit events comes with subject -1, and becauseof this i cant filter them > with audit_user policy. When i`m using console "login" all work as designed > and i got logged in user in the subject. I think that xdm must be patched to > support audit, i found audit code in the > login sources. My be someone > already did such patches? This is correct -- login services must be modified to properly set up user audit state at login. I am not familiar with work relating to this with xdm, kdm, gdm, etc, but it would be very good to see this happen. Possibly, e-mail to the port maintainers of these may be called for, possibly with patches. > 3) All services running from rc scripts also using "-1" as their subject. > How can i change subject for such programs? E.g. mysql work with myslq > uid/gid and i want create special policy for the mysql in the audit_user > file, but "subject" of such events is always "-1", so i cant do this. Hmm. Right now there isn't a tool to do this, but there probably should be. > P.S. I`m using FreeBSD-STABLE. The patch you've submitted will go first into OpenBSM, then 7-CURRENT, and then at some point an MFC to 6-STABLE. Fortunately, you've caught be just before I released OpenBSM 1.0 alpha 15, which will be the last import (we hope) before 7.0. If you're aware of any other outstanding issues relating to OpenBSM, please let me know. Robert N M Watson Computer Laboratory University of Cambridge
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20070714164146.Q80803>