From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Regarding Auditing on RHEL 7.1 Date: Thu, 25 Feb 2016 14:52:09 -0500 Message-ID: <2113594.6K0R9tGoXX@x2> References: <5078D98067B1B340BEE9F4F5FF71B8A733E824@BLRXMB02.microfocus.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <5078D98067B1B340BEE9F4F5FF71B8A733E824@BLRXMB02.microfocus.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Sarthak Jain List-Id: linux-audit@redhat.com On Wednesday, February 24, 2016 07:04:08 AM Sarthak Jain wrote: > I am Sarthak Jain working in MicroFocus. I want your small help to clarify > one of my doubt regarding the kernel auditing on RHEL 7.1. I hope you are > the right person to contact. It will just 2 min (max :P) to go through the > problem. > > Assumption: Ideally, if we change the configuration file (for ex- > /etc/hosts), we should be getting audit events for it. > > Scenario: By default, the permissions for '/etc/hosts' is (rw-r-r--). If we > modify this file, then audit events are coming as attached in file - > 'file1.txt'. > > Problem: Let say if we change the permissions of the '/etc/hosts' to > (rw-rw-rw), then audit system is not recording the "CONFIG_CHANGE" event at > all. That is because the audit configuration has not changed. Config change events are specific to changes in the audit system itself. What you get on this is syscall event with a path If you want to get events on changing permissions on a file, then you would put a rule like this: -a always,exit -F path=/etc/hosts -F perms=a -F key=permission-change After modifying the file with chmod, then run: ausearch --start today -k permission-change > I have attached the file - 'file2.txt' for your reference. Can you > please clarify this ? Is it a kernel level bug? No. Its doing what it should. -Steve