SF.net SVN: logwatch:[125]

Revision: 125
          http://logwatch.svn.sourceforge.net/logwatch/?rev=125&view=rev
Author:   stefjakobs
Date:     2012-12-30 16:24:53 +0000 (Sun, 30 Dec 2012)
Log Message:
-----------
0009-Bug649197-Add-AppArmor-log-processing-to-the-audit-service (Thanks:
Willi Mann)
0010-bug-571163-Handle-changes-in-dovecot-logging (Thanks: Kees Cook)

Modified Paths:
--------------
    conf/services/audit.conf
    scripts/services/audit
    scripts/services/dovecot

Modified: conf/services/audit.conf
===================================================================
--- conf/services/audit.conf	2012-12-30 15:55:22 UTC (rev 124)
+++ conf/services/audit.conf	2012-12-30 16:24:53 UTC (rev 125)
@@ -12,7 +12,7 @@
 # Yes = True  = On  = 1
 # No  = False = Off = 0
 
-Title = "Selinux Audit"
+Title = "Kernel Audit"
 
 # Which logfile group...
 LogFile = messages
@@ -21,7 +21,7 @@
 # Note that audit lines may have something like audit(1114839915.618:0)
 # as the service name
 # (Some implementations might not precede it with "kernel:")
-*OnlyService = (kernel:)?\s*(\[\s*\d+\.\d+\]\s*)?(type=[0-9]+\s*)?audit.*
+*OnlyService = (kernel:( \[[ 0-9\.]+\])?)?\s*(type=[0-9]+\s*)?audit.*
 *RemoveHeaders
 
 ########################################################

Modified: scripts/services/audit
===================================================================
--- scripts/services/audit	2012-12-30 15:55:22 UTC (rev 124)
+++ scripts/services/audit	2012-12-30 16:24:53 UTC (rev 125)
@@ -78,7 +78,7 @@
 use strict;
 use Logwatch ':all';
 
-my (%denials, %grants);
+my (%denials, %grants, %loads);
 my @OtherList;
 my $othercount = 0;
 my $Debug = ($ENV{'LOGWATCH_DEBUG'} || 0);
@@ -92,7 +92,7 @@
 my $NumberOfLostMessages = 0;
 my %InvalidContext = ();
 my %BugLog = ();
-my $UELimit = 10;
+my $UELimit = 100;
 my $ThisLine;
 my %Warning = ();
 my %AuditctlStatus = ();
@@ -153,6 +153,22 @@
       $Warning{$ThisLine}++;
     } elsif ( my ($status) = ( $ThisLine =~ /AUDIT_STATUS: (.*)/ ) ) {
       $AuditctlStatus{$status}++; 
+    } elsif ( $ThisLine =~ /audit\([0-9]+\.[0-9]+:[0-9]+\): apparmor=/) {
+        # AppArmor
+        if ( $ThisLine =~ /apparmor="STATUS" operation="profile_(load|replace)" name="([^"]+)"/ ) {
+            # type=1400 audit(1314853473.168:33616): apparmor="STATUS" operation="profile_replace" name="/usr/lib/apache2/mpm-prefork/apache2//DEFAULT_URI" pid=26566 comm="apparmor_parser"
+            $loads{$2}++;
+        } elsif ( $ThisLine =~ /apparmor="DENIED" operation="([^"]+)" parent=\d+ profile="([^"]+)" name="([^"]+)" pid=\d+ comm="([^"]+)"/ ) {
+            # type=1400 audit(1314853822.672:33649): apparmor="DENIED" operation="mknod" parent=27250 profile="/usr/lib/apache2/mpm-prefork/apache2//example.com" name="/usr/share/wordpress/1114140474e5f13bea68a4.tmp" pid=27289 comm="apache2" requested_mask="c" denied_mask="c" fsuid=33 ouid=33
+            # type=1400 audit(1315353795.331:33657): apparmor="DENIED" operation="exec" parent=14952 profile="/usr/lib/apache2/mpm-prefork/apache2//example.com" name="/usr/lib/sm.bin/sendmail" pid=14953 comm="sh" requested_mask="x" denied_mask="x" fsuid=33 ouid=0
+            $denials{$1.' '.$3.' ('.$2.' via '.$4 . ')'}++;
+        } else {
+            $othercount++;
+            $ThisLine =~ s/^\s*//;
+            if ($othercount < $UELimit+1) {
+                push @OtherList, $ThisLine;
+            }
+        }
     } elsif ( $Detail > 9 ) {
 	if ( $ThisLine =~ /avc:\s*denied\s*{\s*([^}]+).*scontext=(\S+)\s*tcontext=(\S+)\s*tclass=(\S+)/ ) {
 	    $denials{$2.' '.$3.' ('.$1.$4 . ')'}++;
@@ -231,6 +247,12 @@
     }
 }
 
+if ( keys %loads ) {
+    print "\n\n*** Loads ***\n";
+    foreach my $key (sort keys %loads) {
+        print "   $key: ". $loads{$key} . " times\n";
+    }
+}
 
 
 if ($Detail and $NumberOfDStarts+$NumberOfDStartsPid) {

Modified: scripts/services/dovecot
===================================================================
--- scripts/services/dovecot	2012-12-30 15:55:22 UTC (rev 124)
+++ scripts/services/dovecot	2012-12-30 16:24:53 UTC (rev 125)
@@ -135,7 +135,7 @@
 while (defined($ThisLine = <STDIN>)) {
      # remove timestamp.  We can't use *RemoveHeaders because we need the
      # service name
-     $ThisLine =~ s/^\w{3} .\d \d\d:\d\d:\d\d [^ ]* //;
+     $ThisLine =~ s/^\w{3} .\d \d\d:\d\d:\d\d //;
      if ( ($ThisLine =~ /(?:ssl-build-param|ssl-params): SSL parameters regeneration completed/) or
           ($ThisLine =~ /ssl-params: Generating SSL parameters/) or
           ($ThisLine =~ /auth-worker/) or
@@ -153,7 +153,8 @@
      } elsif ( $ThisLine =~ /Dovecot (v\d[^ ]* |)starting up( \(core dumps disabled\))?$/) {
          $Restarts++;
          $End = 0;
-     } elsif ( ($User, $Host) = ( $ThisLine =~ /^pop3-login: Login: (.*?) \[(.*)\]/ ) ) {
+     } elsif ( ( ($User, $Host) = ( $ThisLine =~ /^pop3-login: Login: (.*?) \[(.*)\]/ ) ) or
+               ( ($User, $Host) = ( $ThisLine =~ /^pop3-login: Info: Login: user=\<(.*?)\>.*rip=(.*)\, lip=/ ) ) ) {
       if ($Host !~ /$IgnoreHost/) {
          $Host = hostName($Host);
          $Login{$User}{$Host}++;
@@ -161,7 +162,8 @@
          $ConnectionPOP3{$Host}++;
          $Connection{$Host}++;
       }
-   } elsif ( ($User, $Host) = ( $ThisLine =~ /^imap-login: Login: (.*?) \[(.*)\]/ ) ) {
+     } elsif ( ( ($User, $Host) = ( $ThisLine =~ /^imap-login: Login: (.*?) \[(.*)\]/ ) ) or
+               ( ($User, $Host) = ( $ThisLine =~ /^imap-login: Info: Login: user=\<(.*?)\>.*rip=(.*)\, lip=/ ) ) ) {
       if ($Host !~ /$IgnoreHost/) {
          $Host = hostName($Host);
          $Login{$User}{$Host}++;

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.


------------------------------------------------------------------------------
Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
MVPs and experts. ON SALE this month only -- learn more at:
http://p.sf.net/sfu/learnmore_123012