{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/4982","repository_url":"https://api.github.com/repos/facebook/osquery","labels_url":"https://api.github.com/repos/facebook/osquery/issues/4982/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/4982/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/4982/events","html_url":"https://github.com/facebook/osquery/pull/4982","id":351598328,"node_id":"MDExOlB1bGxSZXF1ZXN0MjA5MTUwOTc0","number":4982,"title":"AppArmor table in osquery","user":{"login":"luc-lynx","id":9931901,"node_id":"MDQ6VXNlcjk5MzE5MDE=","avatar_url":"https://avatars0.githubusercontent.com/u/9931901?v=4","gravatar_id":"","url":"https://api.github.com/users/luc-lynx","html_url":"https://github.com/luc-lynx","followers_url":"https://api.github.com/users/luc-lynx/followers","following_url":"https://api.github.com/users/luc-lynx/following{/other_user}","gists_url":"https://api.github.com/users/luc-lynx/gists{/gist_id}","starred_url":"https://api.github.com/users/luc-lynx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/luc-lynx/subscriptions","organizations_url":"https://api.github.com/users/luc-lynx/orgs","repos_url":"https://api.github.com/users/luc-lynx/repos","events_url":"https://api.github.com/users/luc-lynx/events{/privacy}","received_events_url":"https://api.github.com/users/luc-lynx/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-08-17T13:38:32Z","updated_at":"2018-08-17T13:38:41Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/facebook/osquery/pulls/4982","html_url":"https://github.com/facebook/osquery/pull/4982","diff_url":"https://github.com/facebook/osquery/pull/4982.diff","patch_url":"https://github.com/facebook/osquery/pull/4982.patch"},"body":"**Changes description:**\r\n\r\nThis PR adds a new `apparmor_events` table that contains events from [AppArmor](https://wiki.ubuntu.com/AppArmor) which is a Mandatory Access Control System. AppArmor is considered to be more user friendly and easy to audit though it's not as feature-rich as SELinux. \r\n\r\n**Motivation for the PR:**\r\n\r\n* All the events from [Linux Security Modules](https://en.wikipedia.org/wiki/Linux_Security_Modules) are logged into `selinux_events` table so the table gets messy\r\n* There's no way to filter out AppArmor events in `selinux_events` table the table contains raw messages that aren't parsed and tokenised. There's no way to run queries on AppArmor events. \r\n* If OSQUERY events monitoring is in use it opens Audit's netlink socket. AppArmor during its work reports events using Linux's Audit system, so the only way to get logs from AppArmor in this case is to get them from `selinux_events` table.\r\n* I wanted to separate AppArmor events from other LSM events in OSQUERY\r\n\r\n**Technical details:**\r\n\r\n* I filter out AppArmor events by looking for records containing `apparmor=` substring as it's always [added](https://github.com/torvalds/linux/blob/48023102b7078a6674516b1fe0d639669336049d/security/apparmor/audit.c#L64) to AppArmor messages\r\n* The whole audit message from AppArmor is also written into `message` column in `apparmor_events` column\r\n* AppAprmor messages don't go to `selinux_event` table anymore"},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/413868930","html_url":"https://github.com/facebook/osquery/pull/4982#issuecomment-413868930","issue_url":"https://api.github.com/repos/facebook/osquery/issues/4982","id":413868930,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMzg2ODkzMA==","user":{"login":"facebook-github-bot","id":6422482,"node_id":"MDQ6VXNlcjY0MjI0ODI=","avatar_url":"https://avatars3.githubusercontent.com/u/6422482?v=4","gravatar_id":"","url":"https://api.github.com/users/facebook-github-bot","html_url":"https://github.com/facebook-github-bot","followers_url":"https://api.github.com/users/facebook-github-bot/followers","following_url":"https://api.github.com/users/facebook-github-bot/following{/other_user}","gists_url":"https://api.github.com/users/facebook-github-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook-github-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook-github-bot/subscriptions","organizations_url":"https://api.github.com/users/facebook-github-bot/orgs","repos_url":"https://api.github.com/users/facebook-github-bot/repos","events_url":"https://api.github.com/users/facebook-github-bot/events{/privacy}","received_events_url":"https://api.github.com/users/facebook-github-bot/received_events","type":"User","site_admin":false},"created_at":"2018-08-17T13:38:41Z","updated_at":"2018-08-17T13:38:41Z","author_association":"NONE","body":"Thank you for your pull request and welcome to our community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. In order for us to review and merge your code, please sign up at https://code.facebook.com/cla. **If you are contributing on behalf of someone else (eg your employer)**, the individual CLA may not be sufficient and your employer may need the corporate CLA signed.\n\nIf you have received this in error or have any questions, please contact us at [cla@fb.com](mailto:cla@fb.com?subject=CLA%20for%20facebook%2Fosquery%20%234982). Thanks!"}}
{"actor":{"display_login":"facebook-github-bot"}}