-
Notifications
You must be signed in to change notification settings - Fork 204
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ausearch does not find messages of type AVC #351
Comments
If the event is malformed, it is skipped. You can use --debug to see the malformed events. An event is malformed if searchable fields are not in the right order or missing. |
I can confirm that AVC type logs created by apparmor version 3.1.6 are all marked as malformed events. The malformed events would be an issue with apparmor I suppose? |
Yes. If they are going to emit an access decision as an AVC, it has to exactly follow the format of an SE Linux AVC. The AppArmor kernel developers were given the AUDIT type block from 1500 to 1599 a long time ago so that they can format their events any way they wish. The AVC they are using is type number 1400. They should really define AUDIT_AA_DECISION 1500 (or whatever makes sense to AppArmor) and then use that. |
Thanks for the report. I don't think there's anything here for us to do. I hope this was reported to the distribution with the malformed events. Closing this. |
When searching the audit logs for messages using
type=AVC
, ausearch returns nothing even if the audit.log file does contain those entries:This makes the audit framework quite difficult to use, especially in combination with tools like apparmor/SELinux. While the logs are still present, users would expect to find them with ausearch.
Audit Version: 4.0-1
Linux Kernel: 6.7.3
The text was updated successfully, but these errors were encountered: