Log-Munger
view release on metacpan or search on metacpan
share/auditd.yaml view on Meta::CPAN
- string: 'type=APPARMOR_STATUS msg=audit(1700000013.000:469): apparmor="STATUS" info="failed to unpack profile" error=-71 profile="unconfined" pid=123 comm="apparmor_parser"'
result: 'type=APPARMOR_STATUS msg=audit(1700000013.000:469): apparmor="STATUS" info="failed to unpack profile" error=-71 profile="unconfined" pid=123 comm="apparmor_parser"'
negative:
# SELinux AVC prose belongs to AUDITD_AVC, not to AppArmor.
- 'type=AVC msg=audit(1700000008.000:464): avc: denied { read } for pid=4444 comm="httpd" tclass=file'
- 'type=USER_AUTH msg=audit(1700000000.123:456): pid=1234 uid=0'
- 'this is not an auditd record'
AUDITD_APPARMOR_DBUS:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: 'type=USER_AVC msg=audit(1700000014.000:470): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=''apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/systemd1" interface="org.freedesktop.systemd1.Manager" m...
result: 'type=USER_AVC msg=audit(1700000014.000:470): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=''apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/systemd1" interface="org.freedesktop.systemd1.Manager" m...
- string: 'type=USER_AVC msg=audit(1700000015.000:471): pid=1 uid=0 msg=''apparmor="ALLOWED" operation="dbus_signal" bus="session" exe="/usr/bin/dbus-daemon" terminal=?'''
result: 'type=USER_AVC msg=audit(1700000015.000:471): pid=1 uid=0 msg=''apparmor="ALLOWED" operation="dbus_signal" bus="session" exe="/usr/bin/dbus-daemon" terminal=?'''
negative:
# An AppArmor blob in the outer field belongs to AUDITD_APPARMOR.
- 'type=AVC msg=audit(1700000012.000:468): apparmor="DENIED" operation="open" profile="/usr/bin/foo" pid=1234'
- 'type=USER_AUTH msg=audit(1700000000.123:456): pid=1234 uid=0 msg=''op=PAM:authentication acct="root" res=failed'''
- 'this is not an auditd record'
AUDITD_ANOM:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
share/auditd.yaml view on Meta::CPAN
- audit_error
result:
audit_type: 'APPARMOR_STATUS'
audit_id: '1700000013.000:469'
audit_epoch: '1700000013.000'
audit_serial: '469'
mac_result: 'STATUS'
audit_apparmor: 'STATUS'
audit_fields: 'info="failed to unpack profile" error=-71 profile="unconfined" pid=123 comm="apparmor_parser"'
# AppArmor dbus mediation: the AppArmor blob is the nested sub-record.
- string: 'type=USER_AVC msg=audit(1700000014.000:470): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=''apparmor="DENIED" operation="dbus_method_call" bus="system" member="StartUnit" mask="send" name="org.freedesktop.systemd1" pid=2222 label...
enriched:
audit_auid: '4294967295'
audit_epoch: '1700000014'
audit_id: '1700000014.000:470'
audit_msg_addr: '?'
audit_msg_apparmor: 'DENIED'
audit_msg_bus: 'system'
audit_msg_exe: '/usr/bin/dbus-daemon'
audit_msg_hostname: '?'
audit_msg_label: 'snap.foo.bar'
audit_msg_mask: 'send'
audit_msg_member: 'StartUnit'
audit_msg_name: 'org.freedesktop.systemd1'
audit_msg_operation: 'dbus_method_call'
audit_msg_peer_label: 'unconfined'
audit_msg_peer_pid: '1'
audit_msg_pid: '2222'
audit_msg_sauid: '0'
audit_msg_terminal: '?'
audit_pid: '1'
audit_serial: '470'
audit_ses: '4294967295'
audit_type: 'USER_AVC'
share/auditd.yaml view on Meta::CPAN
- audit_ses
- audit_uid
result:
audit_type: 'USER_AVC'
audit_id: '1700000014.000:470'
audit_epoch: '1700000014.000'
audit_serial: '470'
mac_result: 'DENIED'
audit_msg_apparmor: 'DENIED'
audit_fields: 'pid=1 uid=0 auid=4294967295 ses=4294967295'
audit_msg: 'operation="dbus_method_call" bus="system" member="StartUnit" mask="send" name="org.freedesktop.systemd1" pid=2222 label="snap.foo.bar" peer_pid=1 peer_label="unconfined" exe="/usr/bin/dbus-daemon" sauid=0 hostname=? addr=? ter...
# ANOM_ABEND: the outer blob only, with no nested msg.
- string: 'type=ANOM_ABEND msg=audit(1700000010.000:466): auid=1000 uid=1000 ses=3 pid=5555 comm="crasher" exe="/usr/bin/crasher" sig=11 res=1'
enriched:
audit_auid: '1000'
audit_comm: 'crasher'
audit_epoch: '1700000010'
audit_exe: '/usr/bin/crasher'
audit_id: '1700000010.000:466'
audit_pid: '5555'
audit_res: '1'
share/dbus.yaml view on Meta::CPAN
# line. That records which unprivileged process caused a privileged daemon to
# start, which appears nowhere else. systemd logs the start but not the reason
# for it.
#
# The "[system]" / "[session]" tag says which bus, and is optional because the
# configuration-file complaints dbus writes before the bus is up do not carry
# it.
includes:
- base
vars:
# A bus name in reverse-DNS form: "org.freedesktop.systemd1".
DBUS_BUS_NAME: '[\w.-]+'
# A unique connection name: ":1.558".
DBUS_UNIQUE_NAME: ':[0-9]+\.[0-9]+'
vars_templated:
# The optional "[system] " / "[session] " tag.
DBUS_PREFIX: '(?:\[(?<dbus_bus>[% WORD %])\] )?'
# "[system] Activating via systemd: service name='org.freedesktop.fwupd'
# unit='fwupd.service' requested by ':1.558' (uid=989 pid=190138
# comm="/usr/bin/fwupdmgr refresh")"
#
# The requester's comm is the whole argv, quoted, so it contains spaces. The
# trailing parenthesised blob is captured whole and split by the quote-aware
# kv decompose below rather than enumerated here, since which keys appear
# varies with the dbus version.
DBUS_ACTIVATING: '[% DBUS_PREFIX %]Activating (?:via systemd: )?service name=''(?<dbus_service>[% DBUS_BUS_NAME %])''(?: unit=''(?<dbus_unit>[% NOTSPACE %])'')?(?: requested by ''(?<dbus_requested_by>[% DBUS_UNIQUE_NAME %])'')?(?: \((?<dbus_request...
# "[system] Successfully activated service 'org.freedesktop.fwupd'"
DBUS_ACTIVATED: '[% DBUS_PREFIX %]Successfully activated service ''(?<dbus_service>[% DBUS_BUS_NAME %])'''
# "[system] Activation via systemd failed for unit
# 'dbus-org.freedesktop.resolve1.service': Unit ... not found."
DBUS_ACTIVATION_FAILED: '[% DBUS_PREFIX %]Activation via systemd failed for unit ''(?<dbus_unit>[^'']*)'': (?<dbus_error>[% GREEDYDATA %])'
# "[system] Reloaded configuration"
DBUS_RELOADED: '[% DBUS_PREFIX %]Reloaded configuration'
# A configuration complaint, written before the bus tag exists:
# "Unknown group "power" in message bus configuration file".
DBUS_CONFIG_PROBLEM: '[% DBUS_PREFIX %](?<dbus_config_problem>Unknown (?:group|user) "[^"]*" in message bus configuration file)'
# Anything else the bus had to say. The gate is a short list of exact program
# names, so nothing but dbus can land here, and the bus tag is still pulled
# off the front.
DBUS_MESSAGE: '[% DBUS_PREFIX %](?<dbus_message>.+)'
vars_tests:
DBUS_BUS_NAME:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: 'org.freedesktop.fwupd'
result: 'org.freedesktop.fwupd'
- string: 'org.freedesktop.PackageKit'
result: 'org.freedesktop.PackageKit'
negative:
- 'has a space'
DBUS_UNIQUE_NAME:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: ':1.558'
result: ':1.558'
- string: ':1.7094'
result: ':1.7094'
negative:
- 'org.freedesktop.fwupd'
DBUS_PREFIX:
# Wholly optional, so the tail is matched as well, to prove the prefix is
# what was consumed.
test_template: '^(?<TEST>[% TEST_VAR %])Reloaded'
positive:
- string: '[system] Reloaded'
result: '[system] '
- string: 'Reloaded'
result: ''
negative:
- '[system] Something else'
DBUS_ACTIVATING:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: '[system] Activating via systemd: service name=''org.freedesktop.fwupd'' unit=''fwupd.service'' requested by '':1.558'' (uid=989 pid=190138 comm="/usr/bin/fwupdmgr refresh")'
result: '[system] Activating via systemd: service name=''org.freedesktop.fwupd'' unit=''fwupd.service'' requested by '':1.558'' (uid=989 pid=190138 comm="/usr/bin/fwupdmgr refresh")'
# The traditional, non-systemd activation line has no unit.
- string: '[system] Activating service name=''org.freedesktop.PolicyKit1'' requested by '':1.4'''
result: '[system] Activating service name=''org.freedesktop.PolicyKit1'' requested by '':1.4'''
negative:
- '[system] Successfully activated service ''org.freedesktop.fwupd'''
DBUS_ACTIVATED:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: '[system] Successfully activated service ''org.freedesktop.fwupd'''
result: '[system] Successfully activated service ''org.freedesktop.fwupd'''
negative:
- '[system] Reloaded configuration'
DBUS_ACTIVATION_FAILED:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: '[system] Activation via systemd failed for unit ''dbus-org.freedesktop.resolve1.service'': Unit dbus-org.freedesktop.resolve1.service not found.'
result: '[system] Activation via systemd failed for unit ''dbus-org.freedesktop.resolve1.service'': Unit dbus-org.freedesktop.resolve1.service not found.'
negative:
- '[system] Successfully activated service ''org.freedesktop.fwupd'''
DBUS_RELOADED:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: '[system] Reloaded configuration'
result: '[system] Reloaded configuration'
negative:
- '[system] Successfully activated service ''org.freedesktop.fwupd'''
DBUS_CONFIG_PROBLEM:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: 'Unknown group "power" in message bus configuration file'
result: 'Unknown group "power" in message bus configuration file'
- string: 'Unknown user "haldaemon" in message bus configuration file'
result: 'Unknown user "haldaemon" in message bus configuration file'
negative:
- '[system] Reloaded configuration'
DBUS_MESSAGE:
share/dbus.yaml view on Meta::CPAN
patterns:
- DBUS_ACTIVATING
- DBUS_ACTIVATED
- DBUS_ACTIVATION_FAILED
- DBUS_RELOADED
- DBUS_CONFIG_PROBLEM
# last: matches anything, which is only safe because the rule is gated
- DBUS_MESSAGE
tests:
positive:
- string: '[system] Activating via systemd: service name=''org.freedesktop.fwupd'' unit=''fwupd.service'' requested by '':1.558'' (uid=989 pid=190138 comm="/usr/bin/fwupdmgr refresh")'
enriched:
dbus_bus: 'system'
dbus_requested_by: ':1.558'
dbus_requester_comm: '/usr/bin/fwupdmgr refresh'
dbus_requester_pid: '190138'
dbus_requester_uid: '989'
dbus_service: 'org.freedesktop.fwupd'
dbus_unit: 'fwupd.service'
numeric:
- dbus_requester_pid
- dbus_requester_uid
program: 'dbus-broker'
result:
dbus_bus: 'system'
dbus_service: 'org.freedesktop.fwupd'
dbus_unit: 'fwupd.service'
dbus_requested_by: ':1.558'
dbus_requester: 'uid=989 pid=190138 comm="/usr/bin/fwupdmgr refresh"'
- string: '[system] Successfully activated service ''org.freedesktop.fwupd'''
program: 'dbus-broker-launch'
result:
dbus_bus: 'system'
dbus_service: 'org.freedesktop.fwupd'
- string: '[system] Activation via systemd failed for unit ''dbus-org.freedesktop.resolve1.service'': Unit dbus-org.freedesktop.resolve1.service not found.'
result:
dbus_bus: 'system'
dbus_unit: 'dbus-org.freedesktop.resolve1.service'
dbus_error: 'Unit dbus-org.freedesktop.resolve1.service not found.'
- string: '[system] Reloaded configuration'
program: 'dbus-daemon'
result:
dbus_bus: 'system'
# Written before the bus tag exists, so there is no dbus_bus.
- string: 'Unknown group "power" in message bus configuration file'
result:
dbus_config_problem: 'Unknown group "power" in message bus configuration file'
- string: '[system] Rejected send message, 1 matched rules'
result:
dbus_bus: 'system'
dbus_message: 'Rejected send message, 1 matched rules'
negative:
- ''
- string: '[system] Activating via systemd: service name=''org.freedesktop.fwupd'' unit=''fwupd.service'' requested by '':1.558'' (uid=989 pid=190138 comm="/usr/bin/fwupdmgr refresh")'
program: 'dbus-extra'
share/polkit.yaml view on Meta::CPAN
# Patterns are anchored (each must match the whole MESSAGE) and first-match
# wins. Every capture is namespaced with polkit_ .
#
# polkit is the third way an unprivileged account gets to do a privileged
# thing, alongside su and sudo, and the one usually left unwatched.
# "systemctl restart", mounting a disk, installing a package through PackageKit
# and changing a network setting all go through it, and every one of those
# decisions is logged here with the action name and the account that asked.
#
# The action id is the field to key on. It is a stable reverse-DNS-style name
# such as org.freedesktop.systemd1.manage-units, so it groups cleanly, whereas
# the command in brackets is free text that varies per invocation.
includes:
- base
vars_templated:
# "Operator of unix-session:1 FAILED to authenticate to gain authorization
# for action org.freedesktop.systemd1.manage-units for
# system-bus-name::1.234 [systemctl restart foo] (owned by unix-user:neti)"
#
# Someone was asked for a password and did not produce the right one. In bulk
# on a desktop that is a user fumbling; on a server it is not.
POLKIT_AUTH_FAILED: 'Operator of (?<polkit_subject>[% NOTSPACE %]) FAILED to authenticate to gain (?<polkit_scope>[A-Z-]+ )?authorization for action (?<polkit_action>[% NOTSPACE %]) for (?<polkit_caller>[% NOTSPACE %]) \[(?<polkit_command>[^\]]*)\]...
# "Operator of unix-session:1 successfully authenticated as unix-user:neti
# to gain ONE-SHOT authorization for action org.freedesktop.systemd1.manage-units
# for system-bus-name::1.234 [systemctl] (owned by unix-user:neti)"
#
# The scope word matters: ONE-SHOT is a single grant, while a plain
# "authorization" is one that has been retained for the session.
POLKIT_AUTH_OK: 'Operator of (?<polkit_subject>[% NOTSPACE %]) successfully authenticated as (?<polkit_authenticated_as>[% NOTSPACE %]) to gain (?<polkit_scope>[A-Z-]+ )?authorization for action (?<polkit_action>[% NOTSPACE %]) for (?<polkit_caller...
# "Registered Authentication Agent for unix-process:1234:5678 (system bus
# name :1.23 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path
# /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)"
#
# An agent appearing is how a session gains the ability to prompt at all, so
# one registering somewhere unexpected is a finding in itself.
POLKIT_AGENT: '(?<polkit_agent_event>Registered|Unregistered) Authentication Agent for (?<polkit_subject>[% NOTSPACE %])(?: \((?<polkit_agent_detail>[% GREEDYDATA %])\))?'
# Anything else polkitd said. Requires nothing in particular, so it is gated
# rather than gateless and sits last.
POLKIT_MESSAGE: '(?<polkit_message>.+)'
vars_tests:
POLKIT_AUTH_FAILED:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: 'Operator of unix-session:1 FAILED to authenticate to gain authorization for action org.freedesktop.systemd1.manage-units for system-bus-name::1.234 [systemctl restart foo] (owned by unix-user:neti)'
result: 'Operator of unix-session:1 FAILED to authenticate to gain authorization for action org.freedesktop.systemd1.manage-units for system-bus-name::1.234 [systemctl restart foo] (owned by unix-user:neti)'
- string: 'Operator of unix-session:2 FAILED to authenticate to gain ONE-SHOT authorization for action org.freedesktop.udisks2.filesystem-mount for system-bus-name::1.99 [udisksctl mount] (owned by unix-user:alice)'
result: 'Operator of unix-session:2 FAILED to authenticate to gain ONE-SHOT authorization for action org.freedesktop.udisks2.filesystem-mount for system-bus-name::1.99 [udisksctl mount] (owned by unix-user:alice)'
negative:
- 'Operator of unix-session:1 successfully authenticated as unix-user:neti to gain authorization for action x for y [z]'
POLKIT_AUTH_OK:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: 'Operator of unix-session:1 successfully authenticated as unix-user:neti to gain ONE-SHOT authorization for action org.freedesktop.systemd1.manage-units for system-bus-name::1.234 [systemctl] (owned by unix-user:neti)'
result: 'Operator of unix-session:1 successfully authenticated as unix-user:neti to gain ONE-SHOT authorization for action org.freedesktop.systemd1.manage-units for system-bus-name::1.234 [systemctl] (owned by unix-user:neti)'
negative:
- 'Operator of unix-session:1 FAILED to authenticate to gain authorization for action x for y [z]'
POLKIT_AGENT:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: 'Registered Authentication Agent for unix-process:1234:5678 (system bus name :1.23 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)'
result: 'Registered Authentication Agent for unix-process:1234:5678 (system bus name :1.23 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)'
- string: 'Unregistered Authentication Agent for unix-process:1234:5678 (disconnected from bus)'
result: 'Unregistered Authentication Agent for unix-process:1234:5678 (disconnected from bus)'
negative:
- 'Operator of unix-session:1 FAILED to authenticate to gain authorization for action x for y [z]'
POLKIT_MESSAGE:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: 'Loading rules from directory /etc/polkit-1/rules.d'
result: 'Loading rules from directory /etc/polkit-1/rules.d'
negative:
share/polkit.yaml view on Meta::CPAN
field: MESSAGE
anchored: true
patterns:
- POLKIT_AUTH_FAILED
- POLKIT_AUTH_OK
- POLKIT_AGENT
# last: matches anything, which is only safe because the rule is gated
- POLKIT_MESSAGE
tests:
positive:
- string: 'Operator of unix-session:1 FAILED to authenticate to gain authorization for action org.freedesktop.systemd1.manage-units for system-bus-name::1.234 [systemctl restart foo] (owned by unix-user:neti)'
program: 'polkit'
result:
polkit_subject: 'unix-session:1'
polkit_action: 'org.freedesktop.systemd1.manage-units'
polkit_caller: 'system-bus-name::1.234'
polkit_command: 'systemctl restart foo'
polkit_owner: 'unix-user:neti'
- string: 'Operator of unix-session:1 successfully authenticated as unix-user:neti to gain ONE-SHOT authorization for action org.freedesktop.systemd1.manage-units for system-bus-name::1.234 [systemctl] (owned by unix-user:neti)'
program: 'polkit-agent-helper-1'
result:
polkit_subject: 'unix-session:1'
polkit_authenticated_as: 'unix-user:neti'
polkit_scope: 'ONE-SHOT '
polkit_action: 'org.freedesktop.systemd1.manage-units'
polkit_caller: 'system-bus-name::1.234'
polkit_command: 'systemctl'
polkit_owner: 'unix-user:neti'
- string: 'Unregistered Authentication Agent for unix-process:1234:5678 (disconnected from bus)'
result:
polkit_agent_event: 'Unregistered'
polkit_subject: 'unix-process:1234:5678'
polkit_agent_detail: 'disconnected from bus'
- string: 'Loading rules from directory /etc/polkit-1/rules.d'
program: 'polkitd'
result:
polkit_message: 'Loading rules from directory /etc/polkit-1/rules.d'
negative:
# the catch-all takes anything with text in it, so the empty string is
# the only thing this rule can refuse
- ''
- string: 'Operator of unix-session:1 FAILED to authenticate to gain authorization for action org.freedesktop.systemd1.manage-units for system-bus-name::1.234 [systemctl restart foo] (owned by unix-user:neti)'
program: 'polkit-extra'
( run in 2.294 seconds using v1.01-cache-2.11-cpan-b16cb0d3907 )