Comments (5)
According to here https://www.reddit.com/r/redhat/s/OyQGjPd4PF, that means the auid
is unset
if it's 4294967295
. So the real problem is that why auid
is unset?
from tetragon.
According to here https://www.reddit.com/r/redhat/s/OyQGjPd4PF, that means the
auid
isunset
if it's4294967295
. So the real problem is that whyauid
is unset?
yes indeed, usually you initialize the id
s to something not zero otherwise in the case they are not correctly set, you end up assuming root which might have security implications. As an illustration, see this kind of issue in Microsoft omi.
Now why this thing is unset should be indeed investigated to understand, thanks for the report!
from tetragon.
Back to the issue, auid should be supposed to my login/real user Id. Somehow it's always 4294967295. uid is my current user Id, as I switched to root, this is correct. auid should be my user's Id, so I know the action is actually done by who.
If it is 4294967295, then that's what the kernel returns, and we just print it, if there was a bug in Tetragon then we may return garbage data and not specific value that indicates loginuid (auid) is not set.
Some reading first: https://linux.die.net/man/8/pam_loginuid . The loginuid is to track user sessions, and it is set from user space, so you should check your workload, how did you spawn this session and see why the loginduid is not set?
Then the fix is have in the software that spawned this session in the first place is either to use pam_loginuid or audit_setloginuid()
helpers to set it correctly before spawning anything, where it will be inherited by the session. An alternative way is that software could write directly to /proc/self/loginuid
the uid assuming it has CAP_AUDIT_CONTROL.
Hope this helps
from tetragon.
Hey @tixxdz, thanks for sharing!
Quick question, does the auid
ever work for you? Was it able to correctly show the real login users in some cases?
from tetragon.
Hey @tixxdz, thanks for sharing!
Quick question, does the
auid
ever work for you? Was it able to correctly show the real login users in some cases?
Yes it works, when running Tetragon in k8s, docker or standalone just login into the machine through ssh or normal login then inspect the tetragon events. Or to simply test it as root inside the session with the CAP_AUDIT_CONTROL capability enabled
# echo -n "99999" > /proc/self/loginuid
# id
uid=0(root) gid=0(root) groups=0(root)
Will produce:
{
"process_exec": {
"process": {
"exec_id": "OjgyMTAxNDUyNzQzNTozMTQ0NQ==",
"pid": 31445,
"uid": 0,
"cwd": "/root",
"binary": "/usr/bin/id",
"flags": "execve clone",
"start_time": "2024-02-14T07:15:32.466738422Z",
"auid": 99999,
from tetragon.
Related Issues (20)
- panic: runtime error: invalid memory address or nil pointer dereference HOT 1
- No namespace and pod informations into the log
- Documentation: broken links automatic report HOT 1
- cri-o 1.29 Tetragon not show namespace/pod information HOT 1
- Documentation: broken links automatic report HOT 1
- Export Environment Variables in a Process's Context when an event is captured
- Tetragon Failed to Start HOT 1
- Cleanup unnecessary cilium/cilium dependencies HOT 1
- Don't allow Tetragon instance to run when there is another one running HOT 2
- Replace deprecated `grpc.DialContext` HOT 1
- Support Postfix operator in matchBinaries selector HOT 1
- docs: getting started guide assumes a single node cluster
- Documentation: broken links automatic report HOT 1
- vmtests: `pkg.sensors.tracing:TestKprobeRateLimit` and `NoRateLimit` are failing silently because of `panic` in tests
- docs: Network Monitoring section of Getting Started incorrectly indicates no new events
- tests: `pkg.sensors.tracing:TestKprobeRateLimit` and `pkg.sensors.tracing:TestKprobeNoRateLimit` could be optimized
- tests: `pkg.sensors.exec.TestFork` is flaky HOT 1
- Development setup HOT 1
- decouple tracing sensor
- tetragon helm-chart should install CRDs normally HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from tetragon.