Re: Logging failed open() calls on /var/log/audit/audit.log

[Klaus Weidner <klaus@atsec.com>]

On Tue, Jun 27, 2006 at 05:15:53PM -0400, Amy Griffis wrote:
> Robert Giles wrote:     [Tue Jun 27 2006, 04:43:10PM EDT]
> > So if I attempt to access /etc/shadow as a regular user, a "success=no" 
> > audit event is generated to indicate read failure - but if a regular user 
> > attempts to read /var/log/audit/audit.log, nothing happens (no audit event 
> > whatsoever is created).
> 
> This is because the regular doesn't have permissions to read
> /var/log/audit.  Since the path didn't fully resolve to
> /var/log/audit/audit.log, the user didn't actually fail to access
> audit.log, they failed to access /var/log/audit.
> 
> If you would like to see a record in this case, you must add a watch
> for /var/log/audit.

CAPP etc. require audit records for unsuccessful attempts to access
objects, but we've generally used the interpretation that there is no
access attempt to the object if a containing directory already rejects
the directory traversal before getting to the object. It's not ideal but
it's the best fit to the way the path access works.

If you really insist on the audit records, you could weaken the
restrictions on the /var/log/audit/ directory (for example 711
permissions) so that it doesn't reject the traversal. The audit files are
still protected of course.

-Klaus