From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Can we audit writing to character device? Date: Mon, 04 Aug 2014 08:39:15 -0400 Message-ID: <3520636.205oePo5Yz@x2> References: <201408042058.BGD34334.LOFMOSFVOQtFHJ@I-love.SAKURA.ne.jp> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <201408042058.BGD34334.LOFMOSFVOQtFHJ@I-love.SAKURA.ne.jp> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Monday, August 04, 2014 08:58:30 PM Tetsuo Handa wrote: > Hello. > > I tried to audit write syscall on /dev/watchdog in order to check > https://access.redhat.com/site/solutions/707563 . > > I expected that I can do it using > > # auditctl -a exit,always -F filetype=character -F devmajor=10 -F > devminor=130 -F arch=b64 -S write -k watchdog > > but it did not work (even > > # auditctl -a exit,always -F filetype=character -F arch=b64 -S write -k > watchdog > > did not work). The rule matcher only uses the information readily at hand during a syscall. The write syscall is ssize_t write(int fd, const void *buf, size_t count); You can match on anything being passed, like a0=4 or any property of the caller. But it will not know that in this case a0 is an FD and it was opened in another syscall and it goes to /dev/watchdog. What is more likely to work is simply: -a exit,always -w /dev/watchdog -p wa -k watchdog It will detect the opening with write permissions, but not the individual writes. > Is this functionality not implemented? Its too much indirection for the current system. I also don't expect that to change. > Should I do > > # stap -d hpwdt -e 'probe module("hpwdt").function("hpwdt_ping") { > printf("%u\n", gettimeofday_ns()); }' > > instead (if I can't use this functionality) ? If you have to watch writes and you know with some certainty which descriptor the program always uses and which selinux type it uses (assuming hpwdt_t below), you might be able to do something like: -a exit,always -F arch=b64 -S write -F a0=4 -F subj_type=hpwdt_t If you know the buffer size used in the program, you might add -F a2=X where X is the buffer size to help identify writes to the correct descriptor if the descriptor gets reused. -Steve