search

linux-audit / audit-userspace

Linux audit userspace repository
GNU General Public License v2.0
600 stars 209 forks source link

Missing space between "key" and "ARCH" when log_format = ENRICHED #140

Closed bigon closed 3 years ago

bigon commented 4 years ago

Hello,

I just got the following bug on debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=975117 I can confirm this with version 3.0~alpha9.

On my machine, I see the following:

type=SYSCALL msg=audit(1605865139.610:3866): arch=c000003e syscall=46 success=yes exit=60 a0=6 a1=7ffe45fa23c0 a2=4000 a3=7ffe45fa246c items=0 ppid=1 pid=33002 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)^]ARCH=x86_64 SYSCALL=sendmsg AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"

As you can see I've a control character between the two

stevegrubb commented 4 years ago

The event appears to be correctly following . Is it malformed in some way I'm missing? The enriched format has been in use since audit-2.6.

bigon commented 4 years ago

There is a ^] caratecter between key=(null) and ARCH=x86_64

stevegrubb commented 4 years ago

Yes, this is what the enriched format specification calls for: https://github.com/linux-audit/audit-documentation/wiki/SPEC-Audit-Event-Enrichment I tried to quote this above and it somehow got erased.

bigon commented 3 years ago

Thanks, I learned something today.

sgpinkus commented 3 years ago

Thanks @bigon, @stevegrubb.

Have to say, this seems like an odd choice of separator for a human readable log. ^] doesn't print at all on my terminal. I guess it's too hard to change at this point :).

Cheers.

stevegrubb commented 3 years ago

The choice is because "Group Separator" makes sense. There is a group of raw data, and a group of translated data. The translated data is meant to be hidden from view and only used to fill in translations. If, however, you wanted to have this in syslog, the syslog plugin removes the Group Separator since the data no longer part of the audit system.

sgpinkus commented 3 years ago

Hmm OK. On my system (Debian) the body of the /var/log/audit/audit.log and the syslog plugin log appear identical except for ^] separator. That's kind of unexpected. They are both text logs. There is a valid use case for keeping it in audit.log output? I'm sure there is someone relying on it anyway, so .. np.

stevegrubb commented 3 years ago

Generally people sending logs to syslog intend to use splunk/ELK/graylog/alianvault/etc. In that case there is no reason to separate them. But for audit native tool use, the separator is used to hide the translation metadata. There are people that have scripted reports using audit native logs.