{"action":"created","issue":{"url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/15","repository_url":"https://api.github.com/repos/linux-audit/audit-kernel","labels_url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/15/labels{/name}","comments_url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/15/comments","events_url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/15/events","html_url":"https://github.com/linux-audit/audit-kernel/issues/15","id":158228521,"number":15,"title":"BUG: wrong PROCTITLE record for ANOM_LINK creation","user":{"login":"pcmoore","id":8494929,"avatar_url":"https://avatars.githubusercontent.com/u/8494929?v=3","gravatar_id":"","url":"https://api.github.com/users/pcmoore","html_url":"https://github.com/pcmoore","followers_url":"https://api.github.com/users/pcmoore/followers","following_url":"https://api.github.com/users/pcmoore/following{/other_user}","gists_url":"https://api.github.com/users/pcmoore/gists{/gist_id}","starred_url":"https://api.github.com/users/pcmoore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pcmoore/subscriptions","organizations_url":"https://api.github.com/users/pcmoore/orgs","repos_url":"https://api.github.com/users/pcmoore/repos","events_url":"https://api.github.com/users/pcmoore/events{/privacy}","received_events_url":"https://api.github.com/users/pcmoore/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/linux-audit/audit-kernel/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/linux-audit/audit-kernel/labels/priority/high","name":"priority/high","color":"e99695"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-06-02T20:10:06Z","updated_at":"2016-07-19T15:03:41Z","closed_at":null,"body":"When experimenting with the ANOM_LINK event creation, it was found that the proctitle record seemed to have the exe of the ppid instead of the pid's.\r\n\r\nThis has been observed on Fedora kernel 4.1.6-200.fc22.x86_64.\r\n\r\nReproducer\r\n\r\nAs a non-root user:\r\n\r\n    # cd /tmp\r\n    # ln -s /bin/passwd my-passwd\r\n\r\nAs root:\r\n\r\n    # ausearch --start recent -m anom_link -i\r\n    <verify you have nothing>\r\n    # chown lp /tmp/my-passwd       <- but use tab completion after /tmp/m\r\n    <this will fail>\r\n    # ausearch --start recent -m anom_link -i | grep PROCTITLE\r\n    type=PROCTITLE msg=audit(08/27/2015 19:22:40.823:1246) : proctitle=-bash \r\n    type=PROCTITLE msg=audit(08/27/2015 19:22:40.824:1247) : proctitle=su - root \r\n    type=PROCTITLE msg=audit(08/27/2015 19:22:40.824:1248) : proctitle=su - root \r\n    type=PROCTITLE msg=audit(08/27/2015 19:22:43.489:1249) : proctitle=chown lp /tmp/my-passwd \r\n\r\nExpected Results\r\n\r\nI would not expect su to be involved."},"comment":{"url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/comments/233661722","html_url":"https://github.com/linux-audit/audit-kernel/issues/15#issuecomment-233661722","issue_url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/15","id":233661722,"user":{"login":"rgbriggs","id":2224635,"avatar_url":"https://avatars.githubusercontent.com/u/2224635?v=3","gravatar_id":"","url":"https://api.github.com/users/rgbriggs","html_url":"https://github.com/rgbriggs","followers_url":"https://api.github.com/users/rgbriggs/followers","following_url":"https://api.github.com/users/rgbriggs/following{/other_user}","gists_url":"https://api.github.com/users/rgbriggs/gists{/gist_id}","starred_url":"https://api.github.com/users/rgbriggs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rgbriggs/subscriptions","organizations_url":"https://api.github.com/users/rgbriggs/orgs","repos_url":"https://api.github.com/users/rgbriggs/repos","events_url":"https://api.github.com/users/rgbriggs/events{/privacy}","received_events_url":"https://api.github.com/users/rgbriggs/received_events","type":"User","site_admin":false},"created_at":"2016-07-19T15:03:40Z","updated_at":"2016-07-19T15:03:40Z","body":"The four records are from two distinct operations.  The fourth is from chown.  This looks as expected.\r\nThe first three are from tab completion in bash, attempting a stat.  The first is from a child bash.  The second and third are listed as coming from its parent which is also the parent of chown, the current bash shell.  This seems like a lot of stat calls for tab completion, but looks ok to me.  I can't explain the \"su\" entries in the original report unless su execs bash and doesn't update proctitle."}}
{"actor":{"display_login":"rgbriggs"}}