In parse_avc(), two unrelated concerns were bundled under one guard:
if (event_success != S_UNSET && s->success == S_UNSET) {
an.avc_result = AVC_DENIED / AVC_GRANTED; /* concern 1 */
s->success = S_FAILED / S_SUCCESS; /* concern 2 */
}
The guard was correct for concern 2: only propagate the AVC verdict to
s->success when the caller is filtering by success/failure and s->success
hasn't been set yet (syscall pass/fail is authoritative).
However, it also gated concern 1: populating an.avc_result, which is the
field aureport -a prints in the "result" column. Without --success or
--failed on the command line, event_success == S_UNSET, so the block was
skipped entirely and an.avc_result stayed at its initial AVC_UNSET value.
aulookup_result(AVC_UNSET) returns "unset", making the result column
always show "unset" regardless of what the AVC record actually says.
Fix: unconditionally extract the verdict from the record into an.avc_result,
and move the event_success guard to cover only the s->success assignment.
Resolves: RHEL-172047
Signed-off-by: Cropi <alakatos@redhat.com>
Enable TLS in audisp-remote by passing --enable-tls to configure and
adding openssl-devel as a BuildRequires for audispd-plugins.
Resolves: RHEL-172047
Signed-off-by: Cropi <alakatos@redhat.com>
Rebase from 4.0.3 to 4.2.1. The /run/audit/ migration introduced in
upstream 4.1.2 is reverted since the CentOS Stream 10 selinux-policy
has not yet been updated to allow auditd_t to manage the /run/audit/
subdirectory (tracked in RHEL-224026). Drop this patch once the
selinux-policy backport lands.
Resolves: RHEL-172047
Resolves: RHEL-102929
Resolves: RHEL-185097
Signed-off-by: Cropi <alakatos@redhat.com>
- Add auditd.cron (5) man page for time-based log rotation description
Resolves: RHEL-77141
- Remove HALT from space_left_action
- Broadcast warning to users when auditd is about to halt
Resolves: RHEL-73111
- Fix TTY hostname in log messages
Resolves: RHEL-79476
- permtab: remove unsupported syscalls from rules
Resolves: RHEL-59560
- Pluginst must have .conf suffix, otherwise skipped
Resolves: RHEL-58838
- ausearch checkpoint inode fix
Resolves: RHEL-58838
- Audisp-filter: filter audit events and forward them to other plugins
Resolves: RHEL-5199
- Log to console when system is halted due to audit not having enough storage
Resolves: RHEL-990
- auditctl: remove misleasing error with --input file
Resolves: RHEL-5200
- Remove ProtectKernelModules=true from service file
Resolves: RHEL-5200
- Update syscall tables to reflect current kernel
Resolves: RHEL-46969
- af_unix: Restore old behavior
Resolves: RHEL-39955
- Add systemd-tempfiles.d for audit when root fs is read-only
Resolves: RHEL-45311
- ausearch fix error reporting
Resolves: RHEL-45311
The previous few commits intended to make initscripts-service only a
recommends but what ended up happening is that it was both a recommends
and a requires. Let's drop the remaining requires.
