[Bug 296575] Audit records for cron and system-scheduled jobs carry unset audit ID (auid = -1) instead of the job owner for FreeBSD 14.3

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296575

--- Comment #4 from Anuj Telkhade <[email protected]> ---
Hi Team,

Cron binary is not having the audit required integration that's why it is not
giving correct user name for executed cron jobs. This is limitation of cron and
audit.

We have tried to re-compile the cron binary but still it is not working.

Here are the steps we performed:
1.Modified do_command.c - Inserted BSM audit session setup in the cron
grandchild process, after setsid() and before privilege dropping.

2.Fixed build issues

setaudit() takes 1 argument (&ai), not 2.
Replaced au_user_mask() (requires libbsm) with getaudit() to preserve the
current audit mask.
3.Added debug logging - Added log_it messages to confirm the code path is
reached and whether setaudit() succeeds or fails.

4. Built and installed

cd /usr/src/usr.sbin/cron
make clean && make && make 
install service cron restart
 5.Verified
confirmed cron jobs are running.

grep -i chmod /var/log/cron 
still shows subject,-1 for cron chmod jobs, so the fix did not resolve the
issue in this environment.

# praudit -l /var/audit/current | grep -E "chmod|58008|57753" | grep -v grep
header,159,11,execve(2),0,Thu Jul  2 11:03:03 2026, + 959 msec,exec
arg,chmod,700,/var/run/qualys/cloud-agent/sock,path,/bin/chmod,attribute,555,root,wheel,1142940688,36764,0,subject,-1,root,wheel,root,wheel,81709,0,0,0.0.0.0,return,success,0,trailer,159,
header,155,11,fchmodat(2),0,Thu Jul  2 11:03:03 2026, + 959
msec,argument,3,0x41c0,new file
mode,path,/var/run/qualys/cloud-agent/sock,attribute,700,root,wheel,1142940688,49758,0,subject,-1,root,wheel,root,wheel,81709,0,0,0.0.0.0,return,success,0,trailer,155,
header,166,11,execve(2),0,Thu Jul  2 11:03:04 2026, + 87 msec,exec
arg,chmod,600,/etc/qualys/cloud-agent/qagent-edr.conf,path,/bin/chmod,attribute,555,root,wheel,1142940688,36764,0,subject,-1,root,wheel,root,wheel,81724,0,0,0.0.0.0,return,success,0,trailer,166,
header,162,11,fchmodat(2),0,Thu Jul  2 11:03:04 2026, + 87
msec,argument,3,0x8180,new file
mode,path,/etc/qualys/cloud-agent/qagent-edr.conf,attribute,600,root,wheel,1142940688,50170,0,subject,-1,root,wheel,root,wheel,81724,0,0,0.0.0.0,return,success,0,trailer,162,
header,159,11,execve(2),0,Thu Jul  2 11:04:03 2026, + 490 msec,exec
arg,chmod,700,/var/run/qualys/cloud-agent/sock,path,/bin/chmod,attribute,555,root,wheel,1142940688,36764,0,subject,-1,root,wheel,root,wheel,82138,0,0,0.0.0.0,return,success,0,trailer,159,
header,155,11,fchmodat(2),0,Thu Jul  2 11:04:03 2026, + 491
msec,argument,3,0x41c0,new file
mode,path,/var/run/qualys/cloud-agent/sock,attribute,700,root,wheel,1142940688,49758,0,subject,-1,root,wheel,root,wheel,82138,0,0,0.0.0.0,return,success,0,trailer,155,
header,166,11,execve(2),0,Thu Jul  2 11:04:03 2026, + 621 msec,exec
arg,chmod,600,/etc/qualys/cloud-agent/qagent-edr.conf,path,/bin/chmod,attribute,555,root,wheel,1142940688,36764,0,subject,-1,root,wheel,root,wheel,82153,0,0,0.0.0.0,return,success,0,trailer,166,



Please refer attachments for more information.

-- 
You are receiving this mail because:
You are the assignee for the bug.