auditd - Getting only EXECVE in ausearch?

Question

I'd like to use the auditd daemon to log whatever is run as or by root on our servers. To that effect, I added the following lines to /etc/audit/audit.rules:

# Log all commands run as (or by) root
-a exit,always -F arch=b64 -F euid=0 -S execve -k exec_root
-a exit,always -F arch=b32 -F euid=0 -S execve -k exec_root

Works well. Now I'd like to ausearch(8) to return only the actual commands, that have been run. It returns too much for me…

# ausearch -k exec_root -c ausearch -m execve
…
----
time->Fri Jun 17 13:43:08 2016
type=PROCTITLE msg=audit(1466163788.236:26612): proctitle=6175736561726368002D6B00657865635F726F6F74002D63006175736561726368002D6D00657865637665
type=PATH msg=audit(1466163788.236:26612): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=687763 dev=fc:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1466163788.236:26612): item=0 name="/sbin/ausearch" inode=407310 dev=fc:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1466163788.236:26612):  cwd="/home/ask"
type=EXECVE msg=audit(1466163788.236:26612): argc=7 a0="ausearch" a1="-k" a2="exec_root" a3="-c" a4="ausearch" a5="-m" a6="execve"
type=SYSCALL msg=audit(1466163788.236:26612): arch=c000003e syscall=59 success=yes exit=0 a0=559e5b5c5198 a1=559e5b5cb3f8 a2=559e5b5bfba0 a3=559e5b5db000 items=2 ppid=5651 pid=5652 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts3 ses=1 comm="ausearch" exe="/sbin/ausearch" key="exec_root"
----
time->Fri Jun 17 13:50:29 2016
type=PROCTITLE msg=audit(1466164229.888:31811): proctitle=6175736561726368002D6B00657865635F726F6F74002D63006175736561726368002D6D00657865637665
type=PATH msg=audit(1466164229.888:31811): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=687763 dev=fc:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1466164229.888:31811): item=0 name="/sbin/ausearch" inode=407310 dev=fc:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1466164229.888:31811):  cwd="/home/ask"
type=EXECVE msg=audit(1466164229.888:31811): argc=7 a0="ausearch" a1="-k" a2="exec_root" a3="-c" a4="ausearch" a5="-m" a6="execve"
type=SYSCALL msg=audit(1466164229.888:31811): arch=c000003e syscall=59 success=yes exit=0 a0=55cc1c3a0198 a1=55cc1c3a63f8 a2=55cc1c39aba0 a3=55cc1c3b6000 items=2 ppid=6163 pid=6164 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts3 ses=1 comm="ausearch" exe="/sbin/ausearch" key="exec_root"

I would like to ONLY get the type=EXECVE lines, WITHOUT having to use grep… ☺

But as you can see in the example above, adding -m execve to the ausearch(8) command didn' work. It also returned type=PROCTITLE, type=PATH etc.pp. lines.

What's the right way to go?

I'm on Ubuntu 16.04.

Thanks, Alexander

Answer 1

ausearch is meant to return a complete event, not just a single record of the event (ie the TYPE=EXECVE record). Unless you write your own code (see man auparse_feed), I believe you are stuck with a grep.

If you accept your fate of spinning your own code or grepping, I'd suggest you also look at the -i option to ausearch (or equivalent in code). If you are just after all commands executed with an effective uid of root, then the PROCTITLE record might give you less work on rebuilding the commands

# ausearch --event 369
----
time->Fri Jul  8 12:29:05 2016
node=fc23 type=PROCTITLE msg=audit(1467944945.085:369): proctitle=7461696C002D66002F7661722F6C6F672F61756469742F61756469742E6C6F67
node=fc23 type=PATH msg=audit(1467944945.085:369): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=8460740 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL
node=fc23 type=PATH msg=audit(1467944945.085:369): item=0 name="/bin/tail" inode=65179 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL
node=fc23 type=CWD msg=audit(1467944945.085:369):  cwd="/home/burn"
node=fc23 type=EXECVE msg=audit(1467944945.085:369): argc=3 a0="tail" a1="-f" a2="/var/log/audit/audit.log"
node=fc23 type=SYSCALL msg=audit(1467944945.085:369): arch=c000003e syscall=59 success=yes exit=0 a0=564181fc2d10 a1=564181f0a770 a2=564181f1bdb0 a3=564181f0a760 items=2 ppid=902 pid=922 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="tail" exe="/usr/bin/tail" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="cmds"
# ausearch --event 369 -i
----
node=fc23 type=PROCTITLE msg=audit(07/08/2016 12:29:05.085:369) : proctitle=tail -f /var/log/audit/audit.log
node=fc23 type=PATH msg=audit(07/08/2016 12:29:05.085:369) : item=1 name=/lib64/ld-linux-x86-64.so.2 inode=8460740 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL
node=fc23 type=PATH msg=audit(07/08/2016 12:29:05.085:369) : item=0 name=/bin/tail inode=65179 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL
node=fc23 type=CWD msg=audit(07/08/2016 12:29:05.085:369) :  cwd=/home/burn
node=fc23 type=EXECVE msg=audit(07/08/2016 12:29:05.085:369) : argc=3 a0=tail a1=-f a2=/var/log/audit/audit.log
node=fc23 type=SYSCALL msg=audit(07/08/2016 12:29:05.085:369) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x564181fc2d10 a1=0x564181f0a770 a2=0x564181f1bdb0 a3=0x564181f0a760 items=2 ppid=902 pid=922 auid=burn uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=1 comm=tail exe=/usr/bin/tail subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=cmds
[root@fc23 burn]#