linux-audit / audit-documentation Goto Github PK

Original location: https://people.redhat.com/sgrubb/audit/prelude.txt

Source: https://people.redhat.com/sgrubb/audit/audit-events.txt

Source: https://people.redhat.com/sgrubb/audit/audit-rt-events.txt

Please update text in the wiki surrounding the skeleton.c example audispd listener here, to mention it only works correctly plugin conf format set to "binary". The default value is "string".

A note on how data is passed to listeners when format is "string" would also be helpful here. Specifically:

• assert no header is sent
• records are newline terminated, so i.e. it's essentially equivalent to tailing the audit.log.
• clarify guarantees or lack there of about how multi record (line) events are delivered - are they guaranteed to be contiguous? Are they always available all at once without blocking?

Source: https://people.redhat.com/sgrubb/audit/audit-parse.txt

Create a master documentation audit message type dictionary similar to the existing audit field dictionary

Start with audit.h, libaudit.h and ausearch -m 2>&1 | tr ' ' '\n'| grep "^[A-Z]" | tail -n +4 | sort | less

Source: https://people.redhat.com/sgrubb/audit/system-lifecycle.txt

Source: https://people.redhat.com/sgrubb/audit/user-account-lifecycle.txt

Source: https://people.redhat.com/sgrubb/audit/audit-state-diagram.png

See https://people.redhat.com/sgrubb/audit/field-dictionary.txt

It is unclear at this point if this is better a file in the git repo or as a wiki page.

See the GitHub help article and our own wiki page on submitting bug and feature requests:

• https://help.github.com/articles/creating-an-issue-template-for-your-repository
• https://github.com/linux-audit/audit-documentation/wiki/Reporting-Bugs-and-Requesting-Features

We should have a SUBMITTING_PATCHES file which documents how to submit patches to this repository.

An example file from libseccomp:

• https://github.com/seccomp/libseccomp/blob/master/SUBMITTING_PATCHES

We should have a wiki page describing what steps are necessary to enable auditing on Fedora so that it is sufficient for debugging SELinux access/AVC denials.

Stub wiki page: https://github.com/linux-audit/audit-documentation/wiki/HOWTO-Fedora-Enable-Auditing

See Steve's people.redhat.com page: https://people.redhat.com/sgrubb/audit

Source: https://people.redhat.com/sgrubb/audit/audit-validation-0.1.tar.gz

Original location: https://people.redhat.com/sgrubb/audit/visualize/index.html

Source: https://people.redhat.com/sgrubb/audit/user-login-lifecycle.txt

Source: https://people.redhat.com/sgrubb/audit/event-enrichment

Source: https://people.redhat.com/sgrubb/audit/ausearch-test-0.5.tar.gz

At the very least we need a Wiki landing page and a pointer to it from the repository's README file so it is easily found.

The quick answer here is to simply use the Linux Kernel format, but we need something more explicit as non-kernel developers and non-git users, such as Steve are having a hard time understanding git commits.

Improve upon the basic information on our bug report and feature request wiki page:

Wiki Page