Created attachment 174831 [details] jailaudit patch jailaudit fails when auditdistd is running in the server. auditdistd creates several jails to isolate the processes in charge of transmitting the audit traces generated by auditd. These jails have a setup and naming convention that is not expected by jailaudit (namely, not having base installed), causing it to fail. See https://wiki.freebsd.org/auditdistd for more information Exemple of the execution in 10.3-RELEASE: # jailaudit generate Downloading a current audit database: pkgng support enabled, using /usr/local/sbin/pkg version 1.8.7. jexec: execvp: ls: No such file or directory pkg: open(/bin/sh): No such file or directory pkg: open(/bin/sh): No such file or directory pkg: Unable to determine ABI pkg: Cannot parse configuration file! jexec: execvp: ls: No such file or directory pkg: open(/bin/sh): No such file or directory pkg: open(/bin/sh): No such file or directory pkg: Unable to determine ABI pkg: Cannot parse configuration file! jexec: execvp: ls: No such file or directory pkg: open(/bin/sh): No such file or directory pkg: open(/bin/sh): No such file or directory pkg: Unable to determine ABI pkg: Cannot parse configuration file! jexec: execvp: ls: No such file or directory pkg: open(/bin/sh): No such file or directory pkg: open(/bin/sh): No such file or directory pkg: Unable to determine ABI pkg: Cannot parse configuration file! You can find attached a patch that only accesses the jails when '/var/db/pkg' exists.
Could you give me an example of the jls output while the audistd jails are running? I rather would like not to use /var/db/pkg as reference if a generate for a jail should be run.
Jailhost that is running auditdistd in sender mode (client) JID IP Address Hostname Path 2 10.10.11.10 my-jail /usr/jails/my-jail 43 - auditdistd: sender (hostname) /var/empty 45 - proto_tls client: tls://10.10.10.1 /var/empty Server that is receiving all the auditd traces (server) JID IP Address Hostname Path 2 - auditdistd: sender (hostname) /var/empty 3 - proto_tls client: tls://10.10.10.1 /var/empty 5 - proto_tls server /var/empty 6 - auditdistd: receiver (hostname) /var/empty 7 - proto_tls server /var/empty 6 - auditdistd: receiver (client1) /var/empty 7 - proto_tls server /var/empty 8 - auditdistd: receiver (client2) /var/empty 9 - proto_tls server /var/empty 10 - auditdistd: receiver (client3) /var/empty 11 - proto_tls server /var/empty 12 - auditdistd: receiver (client4) /var/empty 13 - proto_tls server /var/empty
Will be fixed in version 1.5.2, jailaudit will ignore jails with root path /var/empty see https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=212847
I have tested the new version in the lab and it works fine with the exception of the newly installed servers, that don't have jails running yet. In this case, we only have auditdistd jails running. # jls JID IP Address Hostname Path 8 - auditdistd: sender (hostname) /var/empty 9 - proto_tls client: tls://10.30 /var/empty # jailaudit generate Downloading a current audit database: pkgng support enabled, using /usr/local/sbin/pkg version 1.8.7. cat: /usr/local/jailaudit/tmp/_jailaudit_allports: No such file or directory The error seems to happen in line 80. The the JLS function returns an empty list (because we don't have jails running) and line 83 is expecting the temporary file with the list of ports to exists.
Will be fixed in 1.5.2 too.
Hi, 1.5.2 is in ports.