problem with capabilities inheritance and auditing in python
Xavier Toth
txtoth at gmail.com
Thu Feb 5 15:55:06 UTC 2009
I've set the capabilities on a script that runs some python code with
auditing calls in it but I'm not getting audit records written to the
audit log. From what I've read I thought the +i would all the
capability to be inherited across execve but this doesn't appear to be
the case. Can anyone help me understand what's going wrong here? Is
there a way in the python code to get the capabilities to see if
indeed cap_audit_write was inherited?
sudo /usr/sbin/setcap cap_audit_write+pei audit_test
-------------------------------------------------------- audit_test
-----------------------------------------------------------------------
#!/bin/sh
/usr/bin/python2 audit_test.py
--------------------------------------------------------
audit_test.py -------------------------------------------------------------------
import audit
import traceback
import errno
import sys, os
def test():
msg = "foo"
try:
audit_fd = audit.audit_open()
if audit_fd < 0:
print("Error connecting to audit daemon")
sys.exit(1)
except:
print("Failed to connecting to audit daemon: %s : %s" % (
sys.exc_info()[0], traceback.format_exc()))
sys.exit(1)
hostname = 'unknown'
hostaddr = 'unknown'
ttyname = 'unknown'
try:
hostname = socket.gethostname()
try:
hostaddr = socket.gethostbyname(hostname)
except:
hostaddr = 'unknown'
except:
hostname = 'unknown'
try:
ttyname = os.readlink('/proc/self/fd/0')
if ttyname.find('/dev') != 0:
ttyname = 'notatty'
except:
ttyname = 'unknown'
try:
print "call audit_log_user_message"
rc = audit.audit_log_user_message(audit_fd,
audit.AUDIT_LABEL_LEVEL_CHANGE, msg, hostname, hostaddr, ttyname, 0);
rc = audit.audit_log_user_message(audit_fd,
audit.AUDIT_TRUSTED_APP, msg, hostname, hostaddr, ttyname, 0);
if rc < 0:
print("Error writing to audit")
sys.exit(1)
except:
print("Failed to write audit: %s : %s" % ( sys.exc_info()[0],
traceback.format_exc()))
sys.exit(1)
if __name__ == '__main__':
test()
--------------------------------------------------------------------------------------------------------------------------------------------------------
Ted
More information about the devel
mailing list