auditd and CAP_AUDIT_READ
Richard Guy Briggs
rgb at redhat.com
Fri Nov 16 02:11:36 UTC 2018
On 2018-11-15 23:45, Steve Grubb wrote:
> On Thu, 15 Nov 2018 08:23:46 -0500
> Richard Guy Briggs <rgb at redhat.com> wrote:
>
> > > I thought that the prime audit connection requires a capability
> > > check to ensure a process without proper privilege does not replace
> > > the audit daemon...since that's now possible. Are there privilege
> > > checks for who can connect to the audit socket? Shouldn't that
> > > process also have CAP_AUDIT_READ since that is what it will be
> > > doing?
> >
> > The only cap that will let a daemon be checked for replacement is
> > CAP_AUDIT_CONTROL. CAP_AUDIT_READ is only used for the unreliable
> > reception of multicast audit log records.
> >
> > The unicast socket is gated by CAP_AUDIT_CONTROL and CAP_AUDIT_WRITE.
> > The multicast read-only unreliable socket is gated by
> > CAP_AUDIT_READ.
>
> My understanding was that CAP_AUDIT_READ was required by everything
> that read, including unicast. That is why it checks that capability
> CAP_AUDIT_READ. Shouldn't everything reading need that capability?
No. CONTROL already did that. READ *was* only ever and still is only
for the bind function of the multicast socket. Full stop.
> -Steve
- RGB
--
Richard Guy Briggs <rgb at redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
More information about the Linux-audit
mailing list