From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: Why there is no PATH record for change file time syscalls ?(utimensat)
Date: Thu, 07 Sep 2017 18:32:39 -0400 [thread overview]
Message-ID: <1628150.CVmOzTQLRi@x2> (raw)
In-Reply-To: <395391504692198@web21o.yandex.ru>
On Wednesday, September 6, 2017 6:03:18 AM EDT Lev Olshvang wrote:
> I got only following SYSCALL record in audit log for 'touch -t ' command, no
> CWD, no PATH record
Out of curiosity, what kind of rule were you using?
> type=SYSCALL msg=audit(1503837757.149:266995):
> arch=c000003e syscall=280 success=yes exit=0 a0=0 a1=0 a2=7fffbb26bb10 a3=0
> items=0 ppid=101 pid=102 auid=1000 uid=0 gid=31 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 tty=pts4 ses=1 comm="touch" exe="/bin/touch"
> key="times"
I think you found a problem. I also think the syscall should be added to:
include/asm-generic/audit_change_attr.h
I think this syscall and others have been added since the watch permissions
files were setup.
-Steve
next prev parent reply other threads:[~2017-09-07 22:32 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-06 10:03 Why there is no PATH record for change file time syscalls ?(utimensat) Lev Olshvang
2017-09-07 22:32 ` Steve Grubb [this message]
2017-09-08 8:41 ` Richard Guy Briggs
2017-09-08 13:27 ` Steve Grubb
2017-09-08 15:15 ` Richard Guy Briggs
2017-09-08 15:38 ` Steve Grubb
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1628150.CVmOzTQLRi@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.