PVF: consider fetching audit logs with netlink

[mrcnski]

Instead of parsing audit logs, we might be able to connect to audit via netlink and observe audit events directly. see man 3 audit_open and further links.

See #2009 (comment) by @s0me0ne-unkn0wn.

[mrcnski]

@s0me0ne-unkn0wn Does this work even if audit logging is disabled? That might be an advantage, along with not having to locate the audit file location (it is different on some systems) etc.

[s0me0ne-unkn0wn]

Well, if audit logging is disabled in the sense that systemd does not write the log to disk, the audit events should still be available. But the audit may be disabled altogether on the kernel level, in that case, no audit events are available, it can be checked with audit_is_enabled

[s0me0ne-unkn0wn]

I'll take this one for myself, as I'm more or less familiar with netlink and kernel audit. However, I've never tried using it as non-root. The first thing that should be checked is whether it's worth implementing at all. If it requires root privilege, it doesn't make sense. The current implementation (the log parsing) fails on every host I tried, as the audit logs are not usually exposed to normal users.

[mrcnski]

Awesome, thank you! Let me know what you find out.

The current implementation (the log parsing) fails on every host I tried, as the audit logs are not usually exposed to normal users.

Yeah, so we only use them for informative purposes right now. Hopefully, there is at least one validator who is ignoring our recommendation not to run as root, who would notice any warnings that we log and inform us. 🙃

[s0me0ne-unkn0wn]

Nope, no miracle happened. You cannot subscribe to audit events as non-root. Probably, that's not that strict, I mean, running as a user who is a member of the audit group may help, and setcap also allows to give users permissions for audit events, but those requirements are even harder to enforce as the exact behavior may depend on distribution, kernel version, and system configuration.

Considering that, I'm not sure it makes sense to put any effort into implementing this.

[mrcnski]

Related: #2324

[bkchr]

In the light of #2461, do we still need this?

[s0me0ne-unkn0wn]

In the light of #2461, do we still need this?

If we're not going to ever enforce running node as root, I'd say no.
If we're switching to PolkaVM, I'd say no.
Otherwise, that may be somewhat useful :)

[bkchr]

So that sounds to me like a "no" and we can close this issue.

[mrcnski]

Can reopen if we need this in the future.