documentation_complete: true

title: 'System Accounting with <tt>auditd</tt>'

description: "The audit service provides substantial capabilities\nfor recording system activities. By default, the service audits about\nSELinux AVC denials and certain types of security-relevant events\nsuch as system logins, account modifications, and authentication\nevents performed by programs such as sudo.\nUnder its default configuration, <tt>auditd</tt> has modest disk space\nrequirements, and should not noticeably impact system performance.\n<br /><br />\nGovernment networks often have substantial auditing\nrequirements and <tt>auditd</tt> can be configured to meet these\nrequirements.\nExamining some example audit records demonstrates how the Linux audit system\nsatisfies common requirements.  \nThe following example from Fedora Documentation available at \n<tt><weblink-macro link=\"http://docs.fedoraproject.org/en-US/Fedora/13/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages.html\" /></tt>\nshows the substantial amount of information\
    \ captured in a\ntwo typical \"raw\" audit messages, followed by a breakdown of the most important\nfields. In this example the message is SELinux-related and reports an AVC\ndenial (and the associated system call) that occurred when the Apache HTTP\nServer attempted to access the <tt>/var/www/html/file1</tt> file (labeled with\nthe <tt>samba_share_t</tt> type):\n<pre>type=AVC msg=audit(1226874073.147:96): avc:  denied  { getattr } for pid=2465 comm=\"httpd\"\npath=\"/var/www/html/file1\" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0 \ntcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file\n\ntype=SYSCALL msg=audit(1226874073.147:96): arch=40000003 syscall=196 success=no exit=-13 \na0=b98df198 a1=bfec85dc a2=54dff4 a3=2008171 items=0 ppid=2463 pid=2465 auid=502 uid=48\ngid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=6 comm=\"httpd\"\nexe=\"/usr/sbin/httpd\" subj=unconfined_u:system_r:httpd_t:s0 key=(null)\n</pre>\n<ul>\n<li><tt>msg=audit(1226874073.147:96)</tt>\n\
    <ul><li>The number in parentheses is the unformatted time stamp (Epoch time)\nfor the event, which can be converted to standard time by using the\n<tt>date</tt> command.\n</li></ul>\n</li>\n<li><tt>{ getattr }</tt>\n<ul><li>The item in braces indicates the permission that was denied. <tt>getattr</tt>\nindicates the source process was trying to read the target file's status information.\nThis occurs before reading files. This action is denied due to the file being\naccessed having the wrong label. Commonly seen permissions include <tt>getattr</tt>,\n<tt>read</tt>, and <tt>write</tt>.</li></ul>\n</li>\n<li><tt>comm=\"httpd\"</tt>\n<ul><li>The executable that launched the process. The full path of the executable is\nfound in the <tt>exe=</tt> section of the system call (<tt>SYSCALL</tt>) message,\nwhich in this case, is <tt>exe=\"/usr/sbin/httpd\"</tt>.\n</li></ul>\n</li>\n<li><tt>path=\"/var/www/html/file1\"</tt>\n<ul><li>The path to the object (target) the process attempted to access.\n\
    </li></ul>\n</li>\n<li><tt>scontext=\"unconfined_u:system_r:httpd_t:s0\"</tt>\n<ul><li>The SELinux context of the process that attempted the denied action. In\nthis case, it is the SELinux context of the Apache HTTP Server, which is running\nin the <tt>httpd_t</tt> domain.\n</li></ul>\n</li>\n<li><tt>tcontext=\"unconfined_u:object_r:samba_share_t:s0\"</tt>\n<ul><li>The SELinux context of the object (target) the process attempted to access.\nIn this case, it is the SELinux context of <tt>file1</tt>. Note: the <tt>samba_share_t</tt>\ntype is not accessible to processes running in the <tt>httpd_t</tt> domain.</li>\n</ul>\n</li>\n<li> From the system call (<tt>SYSCALL</tt>) message, two items are of interest:\n<ul><li><tt>success=no</tt>: indicates whether the denial (AVC) was enforced or not.\n<tt>success=no</tt> indicates the system call was not successful (SELinux denied\naccess). <tt>success=yes</tt> indicates the system call was successful - this can\nbe seen for permissive domains\
    \ or unconfined domains, such as <tt>initrc_t</tt>\nand <tt>kernel_t</tt>.\n</li>\n<li><tt>exe=\"/usr/sbin/httpd\"</tt>: the full path to the executable that launched\nthe process, which in this case, is <tt>exe=\"/usr/sbin/httpd\"</tt>.\n</li></ul>\n</li></ul>"
