Issued:

2012-06-20

Updated:

2012-06-20

RHBA-2012:0929 - audit bug fix and enhancement update

Synopsis

audit bug fix and enhancement update

Type/Severity

Bug Fix Advisory (none)

Topic

Updated audit packages that fix multiple bugs and add several enhancements are now available for Red Hat Enterprise Linux 6.

Description

The audit packages contain the user space utilities for storing and searching the audit records which have been generated by the audit subsystem in the Linux 2.6 kernel.

The audit packages have been upgraded to upstream version 2.2, which provides a number of bug fixes and enhancements over the previous version. The version 2.2 packages introduce the following enhancements:

• The "auditctl" command now allows shell-escaped file names for better handling of file names with spaces in them.

• There is a new utility, auvirt, that extracts a report about the virtualization events.

• The auditd.conf configuration option, "tcp_max_per_addr", now allows up to 1024 concurrent connections from the same IP address. While this is not recommended for normal use, it helps in situations where a number of client systems are behind a NAT, which causes them to appear to have the same IP address.

This update also fixes the following bugs:

• Previously, not enough information was parsed to determine whether audit records are part of the same event if the server's node name was longer than approximately 80 characters. With this update, the problem has been fixed. (BZ#803349)

• This update fixes a typo in the audit.rules(7) man page. (BZ#797848)

Also, this update adds the following enhancements:

• Prior to this update, if the audit rules had a typo or the command was not supported by the Linux kernel, either an error was triggered and you were able to stop processing the rules or, as the other option, you were able to ignore any errors in which case it completed everything it could but returned success. This update introduces the "-c" option to auditctl which works like the ignore option, but instead of returning success, the "-c" option returns failure if any rule triggers an error. Note that like the ignore option, the "-c" option continues to process all audit rules. (BZ#658630)

• This release adds support for a new kernel auditing feature that allows for inter-field comparisons. For each audit event, the Linux kernel collects information about what is causing the event. Now, you can use the "-C" option to compare: "auid", "uid", "euid", "suid", "fsuid", or "obj_uid"; and "gid", "egid", "sgid", "fsgid", or "obj_gid". The two groups cannot be mixed. Comparisons can use either the equal or not equal operators. Note that for this enhancement to work, the system must boot the Linux 2.6.32-244 kernel or later. (BZ#766920)

All audit users are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258

Affected Products

Updated Packages

• audit-libs-static-2.2-2.el6.x86_64.rpm
• audit-debuginfo-2.2-2.el6.x86_64.rpm
• audit-libs-2.2-2.el6.ppc64.rpm
• audit-libs-python-2.2-2.el6.ppc64.rpm
• audit-2.2-2.el6.i686.rpm
• audit-libs-devel-2.2-2.el6.s390.rpm
• audispd-plugins-2.2-2.el6.i686.rpm
• audit-libs-python-2.2-2.el6.x86_64.rpm
• audit-libs-devel-2.2-2.el6.ppc.rpm
• audit-libs-2.2-2.el6.i686.rpm
• audit-debuginfo-2.2-2.el6.s390.rpm
• audit-2.2-2.el6.ppc64.rpm
• audit-libs-devel-2.2-2.el6.i686.rpm
• audit-libs-2.2-2.el6.x86_64.rpm
• audit-2.2-2.el6.src.rpm
• audit-libs-python-2.2-2.el6.i686.rpm
• audit-libs-static-2.2-2.el6.i686.rpm
• audit-debuginfo-2.2-2.el6.i686.rpm
• audit-libs-static-2.2-2.el6.ppc64.rpm
• audit-libs-2.2-2.el6.s390.rpm
• audit-libs-devel-2.2-2.el6.x86_64.rpm
• audit-libs-2.2-2.el6.ppc.rpm
• audit-libs-static-2.2-2.el6.s390x.rpm
• audispd-plugins-2.2-2.el6.x86_64.rpm
• audit-libs-python-2.2-2.el6.s390x.rpm
• audit-debuginfo-2.2-2.el6.ppc.rpm
• audit-debuginfo-2.2-2.el6.ppc64.rpm
• audispd-plugins-2.2-2.el6.s390x.rpm
• audit-libs-2.2-2.el6.s390x.rpm
• audit-2.2-2.el6.s390x.rpm
• audit-libs-devel-2.2-2.el6.s390x.rpm
• audispd-plugins-2.2-2.el6.ppc64.rpm
• audit-debuginfo-2.2-2.el6.s390x.rpm
• audit-libs-devel-2.2-2.el6.ppc64.rpm
• audit-2.2-2.el6.x86_64.rpm

Fixes

• This content is not included.BZ - 658630
• This content is not included.BZ - 797848
• This content is not included.BZ - 803349

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.