BUG: import the ausearch-test code into a new repo on github.com/linux-audit

[pcmoore]

Source: https://people.redhat.com/sgrubb/audit/ausearch-test-0.5.tar.gz

[WOnder93]

I could take on this and #11, but I don't have permissions to create a repo in linux-audit. I think only @pcmoore can do that.

[pcmoore]

I think a good first step would be to unpack the ausearch-test into a personal repository for review before inclusion in the linux-audit organization. Discussions on the mailing list have raised some questions in my mind about these tests.

The same applies to #11 and the audit-validation tests.

[WOnder93]

That's a good idea. I imported the two available versions (0.5 and 0.6) of ausearch-test here:

https://github.com/WOnder93/ausearch-test

What discussion and questions do you have in mind?

[pcmoore]

Thanks for unpacking the tests @WOnder93.

As far as questions are concerned, this isn't a complete list, but this is what comes to mind quickly:

• How does one install the test (e.g. what dependencies are there, if any)?
• It looks like the entire test (suite?) is a single C file, are there multiple tests in that file? If so, is there any documentation about what is tested, or does one need to read the C source?
• Once the tests are described somewhere, do we actually agree that these tests are correct and useful?
• If the tests are correct and useful, does the tests need any work before we add it to the linux-audit GH organization?

[WOnder93]

• How does one install the test (e.g. what dependencies are there, if any)?
• It looks like the entire test (suite?) is a single C file, are there multiple tests in that file? If so, is there any documentation about what is tested, or does one need to read the C source?

ausearch-test itself is just a single C program and a couple helper bash scripts. The usage of the test is described quite nicely in the included README file (which I now slightly edited and converted to Markdown).

• Once the tests are described somewhere, do we actually agree that these tests are correct and useful?

I haven't looked closely at the audit-validation test yet, but ausearch-test is definitely useful. It can be used for regression-testing the ausearch program as well as for making sure that ausearch can parse newly introduced record types.

Correctness is not something I would worry about, since it is just a tool for discovering possible problems. Think of it as a kind of fuzzer for ausearch. It is a really simple tool - the whole code is smaller than the file containing the license :)

• If the tests are correct and useful, does the tests need any work before we add it to the linux-audit GH organization?

Well, there is one thing - ausearch-test requires an audit.log file containing a collection of sample records (ideally acquired from real running systems). The tool's documentation expects each user to maintain their own database of records, but I think it would be much better if we have a single 'official' collection maintained inside the repository (then we could e.g. set up Travis CI on audit-userspace to check ausearch for regressions on each commit). I'm sure @stevegrubb has a personal collection somewhere, maybe he would be willing to share it? One possible problem could be that the records may contain sensitive information so we may either need to either generate some 'safe' collection or somehow filter/sanitize Steve's file if he is collecting the records from some live system(s).

@stevegrubb, do you have a record collection we could publish? Or how difficult do you think it would be to produce a reasonably complete collection that we could have in the public repository?