From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Timothy R. Chavez" Subject: Re: File watching Date: Tue, 20 Jun 2006 13:22:58 -0500 Message-ID: <1150827779.19484.7.camel@localhost.localdomain> References: <4498360A.7090807@ornl.gov> <20060620181024.GA31078@arlut.utexas.edu> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k5KINFjD007812 for ; Tue, 20 Jun 2006 14:23:15 -0400 Received: from e36.co.us.ibm.com (e36.co.us.ibm.com [32.97.110.154]) by mx3.redhat.com (8.13.1/8.13.1) with ESMTP id k5KIN8F2027693 for ; Tue, 20 Jun 2006 14:23:08 -0400 Received: from d03relay04.boulder.ibm.com (d03relay04.boulder.ibm.com [9.17.195.106]) by e36.co.us.ibm.com (8.12.11.20060308/8.12.11) with ESMTP id k5KIN3Ea005173 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Tue, 20 Jun 2006 14:23:03 -0400 Received: from d03av01.boulder.ibm.com (d03av01.boulder.ibm.com [9.17.195.167]) by d03relay04.boulder.ibm.com (8.13.6/NCO/VER7.0) with ESMTP id k5KINAql119204 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 20 Jun 2006 12:23:12 -0600 Received: from d03av01.boulder.ibm.com (loopback [127.0.0.1]) by d03av01.boulder.ibm.com (8.12.11.20060308/8.13.3) with ESMTP id k5KIN0CU000800 for ; Tue, 20 Jun 2006 12:23:00 -0600 In-Reply-To: <20060620181024.GA31078@arlut.utexas.edu> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Jonathan Abbey Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tue, 2006-06-20 at 13:10 -0500, Jonathan Abbey wrote: > On Tue, Jun 20, 2006 at 01:53:14PM -0400, Steve wrote: > | I have audit set to monitor all system calls for a file. I see some > | system calls for it, but I think some may be missing... If I create the > | file using vi, I only see an open followed by a stat64. Shouldn't there > | be a write of some type? stat and open can't write to a file, can they? > > Generally (and I'm speaking from my experience with Snare, here), one > does not attempt to audit the actual read and write syscalls. Mainly > because there are far, far too many of them, and you need their > performance to be as high as conceivably possible. I think it has more to do with security relevancy than anything. Audit development has primarily been driven by CAPP and LSPP requirements for the last couple of years. -tim > > Instead, you audit the file open, and make a note of whether the file > was opened read-only, or for read/write. If it was opened for > read/write, one presumes that it was written to. > > Jon > > | Thanks, > | Steve > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit