From: Richard Guy Briggs <rgb@redhat.com>
To: Steve Grubb <sgrubb@redhat.com>
Cc: linux-audit@redhat.com
Subject: Re: Unhelpful events
Date: Mon, 7 Jun 2021 13:42:49 -0400 [thread overview]
Message-ID: <20210607174249.GX2268484@madcap2.tricolour.ca> (raw)
In-Reply-To: <5718463.lOV4Wx5bFT@x2>
On 2021-06-07 11:32, Steve Grubb wrote:
> Hello,
>
> While patching up the event normalizer, I run across these events which
> really have no useful information:
>
> type=BPF msg=audit(1622913714.840:15017): prog-id=137 op=UNLOAD
>
> type=TIME_INJOFFSET msg=audit(1622547739.500:4): sec=0 nsec=486383948
Fedora? "-a task,never"?
I assume ghak120 should be present in what you are using by now (v5.11)?
https://github.com/linux-audit/audit-kernel/issues/120
"BUG: accompanying records missing for requried records when no rules present"
> type=NETFILTER_CFG msg=audit(06/06/2021 08:44:53.947:976) : table=filter
> family=bridge entries=0 op=xt_unregister pid=5833
> subj=system_u:system_r:kernel_t:s0 comm=kworker/u16:3
This is as complete as this event is going to get. It is a kernel
event, reaping an unused table after a timeout. See
https://github.com/linux-audit/audit-kernel/issues/25
> Either their syscall record is missing or they simply do not have all the
> necessary information. (Subject, action, object, results)
>
> -Steve
- RGB
--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2021-06-07 17:43 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-07 15:32 Unhelpful events Steve Grubb
2021-06-07 17:42 ` Richard Guy Briggs [this message]
2021-06-07 18:38 ` Steve Grubb
2021-06-07 19:22 ` Richard Guy Briggs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210607174249.GX2268484@madcap2.tricolour.ca \
--to=rgb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=sgrubb@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.