Query regarding to audit netlink call

[Steve Grubb]

On Monday, November 26, 2018 2:09:57 AM EST Avinash Patwari wrote:
> Hi,
> 
> I wrote a program to listen to iptables modification through netlink
> sockets, for this I used NETLINK_AUDIT family, when I execute the program
> and modify the iptables rule, program doesn't receive any message from
> kernel and it will be in blocking mode only. Could you help me to find what
> is wrong in this program or what else I need to do to receive iptables
> notification ?

To receive audit events, you have to register your program as the audit 
daemon by setting the audit pid via audit_set_pid() . Then you will get 
events. All of them. That might be disruptive if you needed auditing. In that 
case, you have 2 options. Write your program as a plugin to the audit daemon. 
There is example code here:

https://github.com/linux-audit/audit-userspace/tree/master/contrib/plugin

The other option is to open a connection to the audit multicast socket as 
systemd's journal does. You might look at it for example code.

-Steve

> I ran this program as a root user & audit deamon is also running.
> 
> ps -eaf | grep -i auditd
> 
> root 499 2 0 Nov16 ? 00:00:00 [kauditd]
> 
>  root 926 1 0 Nov16 ? 00:00:00 /sbin/auditd -n
> 
> 
> I tried configuring  auditctl setting as well directly using auditctl
> command & can see the modifcation with "ausearch -k iptablesChange" command
> output but notification is not received in application.
> 
> Here is the program :-
> 
>  #include "libaudit.h"
> 
> #include <stdio.h>#include <string.h>#include <unistd.h>
> int main(){
>         int rc;
>         struct audit_message rep;
>         int fd;
>         struct sockaddr_nl sa;
> 
>         memset(&sa, 0, sizeof(sa));
>         sa.nl_family = AF_NETLINK;
>         sa.nl_groups = 0;
> 
>         fd = audit_open();
> 
>         bind(fd, (struct sockaddr *) &sa, sizeof(sa));
> 
>         rc = audit_get_reply(fd, &rep, GET_REPLY_BLOCKING, 0);
>         if(rc < 0)
>         {
>                 printf("Error");
>         }
>         else
>         {
>                 printf("msg received %d \n",rep.nlh.nlmsg_type );
>                 break;
>         }
> 
> 
>         audit_close(fd);
> 
>         return 0;}
> 
> Thanks,Avinash