Welcome To openEuler Community
Hey @liu_yangmei , thanks for your contribution to the community.
Bot Usage Manual
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.
Contact Guide
If you have any questions, please contact the SIG: sig-security-facility ,
and any of the maintainers: @mailofzxf, @robertosassu, @zhujianwei001 ,
以下的要求不是强制性的, 未按模板评论时对issue无任何影响
issue处理注意事项:
1. 当前issue受影响的分支提交pr时, 须在pr描述中填写当前issue编号进行关联, 否则无法关闭当前issue;
2. 模板内容需要填写完整, 无论是受影响或者不受影响都需要填写完整内容,未引入的分支不需要填写, 否则无法关闭当前issue;
3. 以下为模板中需要填写完整的内容, 请复制到评论区回复, 注: 内容的标题名称(影响性分析说明, 缺陷严重等级, 受影响版本排查(受影响/不受影响), 修复是否涉及abi变化(是/否))不能省略,省略后defect-manager将无法正常解析填写内容.
评论区可能使用到的指令说明:
| 指令 | 指令说明 | 使用权限 |
|---|---|---|
| /check-issue | 触发defect-manager校验 | 不限 |
| /reason xxx | /reason +挂起或取消条件 | 不限 |
影响性分析说明:
缺陷严重等级:(Critical/High/Moderate/Low)
缺陷根因说明:
受影响版本排查(受影响/不受影响):
- openEuler-20.03-LTS-SP4:
- openEuler-22.03-LTS-SP3:
- openEuler-22.03-LTS-SP4:
- openEuler-24.03-LTS:
- openEuler-24.03-LTS-SP1:
- openEuler-24.03-LTS-SP2:
abi变化(是/否):
- openEuler-20.03-LTS-SP4:
- openEuler-22.03-LTS-SP3:
- openEuler-22.03-LTS-SP4:
- openEuler-24.03-LTS:
- openEuler-24.03-LTS-SP1:
- openEuler-24.03-LTS-SP2:
缺陷issue处理具体操作请参考:
https://atomgit.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/defect-manager-manual.md
pr关联issue具体操作请参考:
https://docs.atomgit.com/docs/help/home/org_project/pullrequests/pr-related-issue
@liu_yangmei 上述整个测试过程可有执行成功的环境？
ausearch -ts 20:49:49 -te 20:50:28 -k filedelete -c rename 其中试试 取消 -c rename 即
ausearch -k filedelete 可有回显信息?
2609版本导致没有规则日志，是因为默认文件中存在 规则 -a task,never
/etc/audit/rules.d/audit.rules
## This set of rules is to suppress the performance effects of the
## audit system. The result is that you only get hardwired events.
-D
## This suppresses syscall auditing for all tasks started
## with this rule in effect. Remove it if you need syscall
## auditing.
-a task,never
即考量系统的性能和资源问题，audit 默认不启动任何规则(-a task,never)
建议加固用例
1> auditctl -l 执行后确保 全局规则没有如下信息：
-a task,never
按照issue 的执行方法且删除规则：-a task,never 后 ，获得预期日志（篇幅因素，节选部分日志）
删除-a task,never 规则后成功生成audit审计日志
ausearch -ts 14:42:54 -te 14:42:55 -k filedelete -c unlink
time->Tue Aug 25 14:42:55 2026
type=PROCTITLE msg=audit(1787640175.431:19139): proctitle=756E6C696E6B0066696C6531
type=PATH msg=audit(1787640175.431:19139): item=1 name="file1" inode=3145733 dev=fd:02 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_home_t:s0 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(1787640175.431:19139): item=0 name="/home/testuser29032" inode=3145729 dev=fd:02 mode=040700 ouid=1000 ogid=1000 rdev=00:00 obj=unconfined_u:object_r:user_home_dir_t:s0 nametype=PARENT cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(1787640175.431:19139): cwd="/home/testuser29032"
type=SYSCALL msg=audit(1787640175.431:19139): arch=c00000b7 syscall=35 success=yes exit=0 a0=ffffffffffffff9c a1=ffffc9c888bb a2=0 a3=1 items=2 ppid=210021 pid=210022 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=84 comm="unlink" exe="/usr/bin/unlink" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="filedelete"
@mailofzxf 未对受影响版本排查/abi变化进行分析
@mailofzxf 未对受影响版本排查/abi变化进行分析
【缺陷描述】：请补充详细的缺陷问题现象描述
触发audit规则后未生成对应的audit审计日志
一、缺陷信息
触发audit规则后未生成对应的audit审计日志
【缺陷所属的os版本】
cat /etc/openEuler-release
openEuler release 26.09 (DevStation)
【内核版本】
6.6.0-163.0.0.1.oe2609.aarch64
【缺陷所属软件及版本号】
audit-4.1.2-3.oe2609
【环境信息】
无
【问题复现步骤】
useradd test
echo "password"∣passwdtest−−stdintouch/home/test/testfile1echo"−aalways,exit−Farch=b64−Srename,unlink,unlinkat,renameat−Fauid>=1000−Fauid!=−1−Fkey=filedelete">/etc/audit/rules.d/filedelete.rulesserviceauditdrestartauditctl−l∣grepfiledeletestarttime=(date +%T)
test用户ssh登录执行命令rename testfile1 file1 testfile1触发audit规则
start_time=$(date +%T)
ausearch -ts $start_time -te $end_time -k filedelete -c rename
【实际结果】
ausearch查找对应规则的audit审计日志失败
[root@openEuler ~]# auditctl -l | grep -iE "unlink|unlinkat|rename|renameat"
[root@openEuler ~]#
[root@openEuler ~]# useradd test
[root@openEuler ~]# echo "$ETS_LOCAL_PASSWD_ROOT" | passwd test --stdin
Changing password for user test.
passwd: all authentication tokens updated successfully.
[root@openEuler ~]# touch /home/test/testfile1
[root@openEuler ~]# ll /home/test/testfile1
-rw-r--r--. 1 root root 0 Aug 21 20:49 /home/test/testfile1
[root@openEuler ~]# echo "-a always,exit -F arch=b64 -S rename,unlink,unlinkat,renameat -F auid>=1000 -F auid!=-1 -F key=filedelete"
> /etc/audit/rules.d/filedelete.rules
[root@openEuler ~]# service auditd restart
Redirecting start to /bin/systemctl start auditd.service
[root@openEuler ~]# auditctl -l | grep filedelete
-a always,exit -F arch=b64 -S rename,unlink,unlinkat,renameat -F auid>=1000 -F auid!=-1 -F key=filedelete
[root@openEuler ~]# date +%T
20:49:49
[root@openEuler ~]# ssh test@localhost
The authenticity of host 'localhost (::1)' can't be established.
ED25519 key fingerprint is SHA256:RYqzY5l/0RFVL5nF4W25Y+N3056nlS+X87sZYHslQqE.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'localhost' (ED25519) to the list of known hosts.
Authorized users only. All activities may be monitored and reported.
test@localhost's password:
Authorized users only. All activities may be monitored and reported.
Welcome to 6.6.0-163.0.0.1.oe2609.x86_64
System information as of time: Fri Aug 21 08:50:16 PM CST 2026
System load: 0.00".
Memory used: 6.9%
Swap used: 0%
Usage On: 5%
IP address: 76.53.216.195
Users online: 2
To run a command as administrator(user "root"),use "sudo
[test@openEuler ~]$ rename testfile1 file1 testfile1
[test@openEuler ~]$ exit
logout
Connection to localhost closed.
[root@openEuler ~]# date +%T
20:50:28
[root@openEuler ~]# ausearch -ts 20:49:49 -te 20:50:28 -k filedelete -c rename
【期望结果】
ausearch查找对应规则的audit审计日志成功
【其他相关附件信息】
【缺陷详情及分析指导参考链接】
二、缺陷分析结构反馈
影响性分析说明：
缺陷严重等级:(Critical/High/Moderate/Low)
缺陷根因说明:
受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2
修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2