From: Steve <m6x@ornl.gov>
To: linux-audit@redhat.com
Subject: Audit and file watching
Date: Wed, 14 Jun 2006 13:41:29 -0400 [thread overview]
Message-ID: <44904A49.7090308@ornl.gov> (raw)
I have been using Audit's file watching ability to monitor when files
are opened. I decided to also try to monitor the deletion of files, so
I told audit to watch for all syscalls pertaining to a particular file.
I then tried opening the file, it worked as before. Then I tried to
delete the file using 'rm /tmp/test.c' the file was deleted from the
filesystem, but audit only showed two syscalls being performed: lstat64
and access. Audit also sent a message saying:
... audit updated rules specifying watch="/tmp/test.c" ...
lstat64 and access can not delete files on the filesystem, can they?
I expected to see unlink...
Any ideas?
Steve
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1300, payload size=279
Jun 14 13:21:06 otslab11 user_actions[8035]:
data="audit(1150305665.265:679): arch=40000003 syscall=196 success=yes
exit=0 a0=bf8c7c49 a1=bf8c6fbc a2=8f1ff4 a3=bf8c7c49 items=1 ppid=7838
pid=8043 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts2 comm="rm" exe="/bin/rm"
subj=user_u:system_r:unconfined_t:s0"
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1307, payload size=43
Jun 14 13:21:06 otslab11 user_actions[8035]:
data="audit(1150305665.265:679): cwd="/tmp/test""
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1302, payload size=143
Jun 14 13:21:06 otslab11 user_actions[8035]:
data="audit(1150305665.265:679): item=0 name="/tmp/test.c" inode=5358237
dev=03:02 mode=0100644 ouid=0 ogid=0 rdev=00:00
obj=user_u:object_r:tmp_t:s0"
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1300, payload size=264
Jun 14 13:21:06 otslab11 user_actions[8035]:
data="audit(1150305665.265:680): arch=40000003 syscall=33 success=yes
exit=0 a0=bf8c7c49 a1=2 a2=8f1ff4 a3=2 items=1 ppid=7838 pid=8043
auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=pts2 comm="rm" exe="/bin/rm" subj=user_u:system_r:unconfined_t:s0"
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1307, payload size=43
Jun 14 13:21:06 otslab11 user_actions[8035]:
data="audit(1150305665.265:680): cwd="/tmp/test""
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1302, payload size=143
Jun 14 13:21:06 otslab11 user_actions[8035]:
data="audit(1150305665.265:680): item=0 name="/tmp/test.c" inode=5358237
dev=03:02 mode=0100644 ouid=0 ogid=0 rdev=00:00
obj=user_u:object_r:tmp_t:s0"
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1305, payload size=113
Jun 14 13:21:06 otslab11 user_actions[8035]:
data="audit(1150305665.265:681): audit updated rules specifying
watch="/tmp/test.c" with dev=4294967295 ino=4294967295 "
next reply other threads:[~2006-06-14 17:41 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-06-14 17:41 Steve [this message]
2006-06-14 17:46 ` Audit and file watching Steve
2006-06-14 18:44 ` Amy Griffis
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=44904A49.7090308@ornl.gov \
--to=m6x@ornl.gov \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.