From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthew Booth Subject: Re: Absolute path names in PATH records Date: Mon, 02 Jul 2007 21:40:39 +0100 Message-ID: <1183408839.4534.17.camel@localhost.localdomain> References: <1183405495.4534.12.camel@localhost.localdomain> <25655.1183408314@turing-police.cc.vt.edu> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0379331090==" Return-path: In-Reply-To: <25655.1183408314@turing-police.cc.vt.edu> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Valdis.Kletnieks@vt.edu Cc: linux-audit List-Id: linux-audit@redhat.com --===============0379331090== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-L0wGF0NsHROIjQfeno+3" --=-L0wGF0NsHROIjQfeno+3 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Mon, 2007-07-02 at 16:31 -0400, Valdis.Kletnieks@vt.edu wrote: > Probably quite a bit, especially if they traverse symlinks and the like. > Additionally, you'd need to track *current* state of $CWD, as the absolut= e > path will change each time a chdir() happens, or if somebody does somethi= ng > like 'mv . ../../foo'. Particularly evil to track: >=20 > cd foo/bar/baz > ./myprog & > cd ../ > mv baz .. >=20 > Where's myprog's ../../bin pointing now? And how would your post process= or > know that happened? I don't think tracking CWD is an issue as it's already right there in the same audit event as the PATH record. The question is one of combining data that's already present in a manner which is easier to process. E.g.: type=3DCWD msg=3Daudit(1183402887.758:2083): cwd=3D"/root" type=3DPATH msg=3Daudit(1183402887.758:2083): item=3D0 name=3D"/etc/ld.so.c= ache" inode=3D2362196 dev=3Dfd:00 mode=3D0100644 ouid=3D0 ogid=3D0=20 rdev=3D00:00 obj=3Dsystem_u:object_r:ld_so_cache_t:s0 In this case, /etc/ld.so.cache is already absolute, but there's no requirement for it to be. Matt --=20 Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490 --=-L0wGF0NsHROIjQfeno+3 Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQBGiWLHNEHqGdM8NJARAjWXAJ43oShkPfdU5CwR7UJ/Dy06oHU57QCfWVro IhpuBz+T2+RU/uAexIfWEtE= =5UkE -----END PGP SIGNATURE----- --=-L0wGF0NsHROIjQfeno+3-- --===============0379331090== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0379331090==--