0

According to the field dictionary[1] there are fields which names are defined by the following regex:

a[[:digit:]+]\[.*\]

I was able to find examples of fields like a4 and a5 (see 2) but it doesn't fit the regex which seems to require a pair of square brackets (so that a4 should be a4[] or a4[foo]). I couldn't find any reference in the Linux Audit source code.

My questions are

  1. Is this regex valid and up-to-date? Or is it an outdated rule which doesn't apply anymore?
  2. Could you suggest me where to look to see how those arguments to the execve syscall are handled?
  3. Could you post an example of a record with a field which fits the regex (assuming the regex is valid)?

Links

  1. https://github.com/linux-audit/audit-documentation/blob/master/specs/fields/field-dictionary.csv#L3
  2. https://www.redhat.com/archives/linux-audit/2012-October/msg00090.html

Note: This question was asked on the Linux Audit mailing list as well but I've not received any feedback yet.

0

This is a summary of the answers I've received from Steve Grubb and Paul Moore. The final message in the related thread can be view here (link).


  1. Is this regex (a[[:digit:]+]\[.*\]) valid and up-to-date? Or is it an outdated rule which doesn't apply anymore?

    This regex is not outdated. It is used when the argument is too long to fit in a single filed like a4. Instead, the argument is splitted into a number of fields so at the end of the day we get

    a4_len=4 a4[0]=l a4[1]=o a4[2]=n a4[3]=g
    

    instead of

    a4=long
    

    In fact the regex could be defined as a[[:digit:]+]\[[:digit:]+\] but the current one does its job so there's no need to fix it.

  2. Could you suggest me where to look to see how those arguments to the execve syscall are handled?

    See kernel/auditsc.c:audit_log_single_execve_arg for details (link).

  3. Could you post an example of a record with a field which fits the regex (assuming the regex is valid)?

    An example can be generated with the Linux Audittest suite (link) or seen here in an old email from the linux audit archive (link).

    Quoting Paul Moore:

    The kernel generates the EXECVE record in kernel/auditsc.c:audit_log_execve_info() and you can find a test for for the EXECVE record in the audit-testsuite (exec_execve).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.