From mboxrd@z Thu Jan 1 00:00:00 1970 From: Linda Knippers Subject: Re: Logging failed open() calls on /var/log/audit/audit.log Date: Tue, 27 Jun 2006 18:16:37 -0400 Message-ID: <44A1AE45.2020405@hp.com> References: <20060627211553.GA11601@zk3.dec.com> <200606271721.05626.sgrubb@redhat.com> <44A1A4EB.6040205@hp.com> <20060627220323.GK4199@devserv.devel.redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20060627220323.GK4199@devserv.devel.redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Alexander Viro Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com Alexander Viro wrote: > On Tue, Jun 27, 2006 at 05:36:43PM -0400, Linda Knippers wrote: > >>Steve Grubb wrote: >> >>>On Tuesday 27 June 2006 17:15, Amy Griffis wrote: >>> >>> >>>>If you would like to see a record in this case, you must add a watch >>>>for /var/log/audit. >>> >>> >>>I don't see a record watching this either. >> >>I think we're missing the directory lookup syscall(s) on watches >>right now. > > > Careful - that's one hell of a hot path. Note that we'll get many of > those for each syscall that does pathname resolution; moreover, when > we hit dcache, we should be careful about blocking. Maybe its not actually the lookup we need. If I do this on RHEL4 I get an audit record for an open failure on /var/log/audit. With the .34 lspp kernel and the 1.2.2 audit tools, I don't get a record for a failed open, even though open seems to be registered with the watch. > [root@cert-e2 kernel]# /sbin/auditctl -l > LIST_RULES: exit,always watch=/var/log/audit/audit.log (0x18) syscall=open,truncate,ftruncate,rename,mkdir,rmdir,creat,link,unlink,symlink,chmod,fchmod,chown,fchown,lchown > LIST_RULES: exit,always watch=/var/log/audit (0xe) syscall=open,truncate,ftruncate,rename,mkdir,rmdir,creat,link,unlink,symlink,chmod,fchmod,chown,fchown,lchown -- ljk