From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: Why there is no PATH record for change file time syscalls
	?(utimensat)
Date: Fri, 08 Sep 2017 09:27:25 -0400
Message-ID: <2478141.FBHdIzEaJG@x2>
References: <395391504692198@web21o.yandex.ru> <1628150.CVmOzTQLRi@x2>
	<20170908084147.GJ29957@madcap2.tricolour.ca>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <20170908084147.GJ29957@madcap2.tricolour.ca>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Richard Guy Briggs <rgb@redhat.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Friday, September 8, 2017 4:41:47 AM EDT Richard Guy Briggs wrote:
> On 2017-09-07 18:32, Steve Grubb wrote:
> > On Wednesday, September 6, 2017 6:03:18 AM EDT Lev Olshvang wrote:
> > > I got only following SYSCALL record in audit log for 'touch -t '
> > > command, no CWD, no PATH record
> > 
> > Out of curiosity, what kind of rule were you using?
> > 
> > > type=SYSCALL msg=audit(1503837757.149:266995):
> > > arch=c000003e syscall=280 success=yes exit=0 a0=0 a1=0 a2=7fffbb26bb10
> > > a3=0 items=0 ppid=101 pid=102 auid=1000 uid=0 gid=31 euid=0 suid=0
> > > fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts4 ses=1 comm="touch" 
> > > exe="/bin/touch" key="times"
> > 
> > I think you found a problem. I also think the syscall should be added to:
> > 
> > include/asm-generic/audit_change_attr.h
> 
> Steve, my naive addition of utime, utimes, futimesat and utimensat to
> include/asm-generic/audit_change_attr.h seems to have made no
> difference.

There seems to be 2 problems. 1) the utimensat syscall not getting a path 
record, 2) you can't use the -F perms=a because the syscall tables seem to be 
way out of date. fchmodat seems to be the last syscall added. There's about 70 
new syscalls that need to be looked through and added. This is the easier of 
the 2 problems.

-Steve

> > I think this syscall and others have been added since the watch
> > permissions files were setup.
> > 
> > -Steve
> 
> - RGB
> 
> --
> Richard Guy Briggs <rgb@redhat.com>
> Sr. S/W Engineer, Kernel Security, Base Operating Systems
> Remote, Ottawa, Red Hat Canada
> IRC: rgb, SunRaycer
> Voice: +1.647.777.2635, Internal: (81) 32635