secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 09:14:33 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fix(antirootkit): ausearch needs --input-logs (plain ausearch reads nothing on gk2 auditd 3.0.9) (ref #915)

Browse Source 
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
This commit is contained in:
CyberMind-FR 2026-07-28 11:42:27 +02:00
parent 0475dc0880
commit d069548a36
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
packages/secubox-antirootkit/api/daemon.py
View File

@ -64,11 +64,17 @@ def _ausearch_since(cursor) -> str:
"""
ts_arg = "recent" if cursor is None else str(int(cursor[0]))
try:
# `--input-logs` is REQUIRED: verified on gk2 (auditd 3.0.9), a plain
# `ausearch -k sbx_exec` returns "<no matches>" even though the raw
# /var/log/audit/audit.log clearly holds key="sbx_exec" records —
# ausearch's default input source reads nothing here. `--input-logs`
# forces it to read the configured log files (audit.log + rotated).
# Without this flag the scanner is silently blind.
r = subprocess.run(
["ausearch", "-k", "sbx_exec", "-ts", ts_arg, "-i"],
["ausearch", "--input-logs", "-k", "sbx_exec", "-ts", ts_arg, "-i"],
capture_output=True,
text=True,
timeout=10,
timeout=15,
)
return r.stdout or ""
except Exception: