From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Subject: Bypassing audit's file watches Date: Fri, 07 Jul 2006 10:58:42 -0400 Message-ID: <44AE76A2.9050205@ornl.gov> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k67Ewtcn032275 for ; Fri, 7 Jul 2006 10:58:55 -0400 Received: from emroute2.ornl.gov (emroute2.ornl.gov [160.91.86.17]) by mx1.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k67EwrBE013063 for ; Fri, 7 Jul 2006 10:58:53 -0400 Received: from emroute2.ornl.gov (localhost [127.0.0.1]) by emroute2.ornl.gov (PMDF V6.2-1x9 #31038) with ESMTP id <0J2100E5AG9YX5@emroute2.ornl.gov> for linux-audit@redhat.com; Fri, 07 Jul 2006 10:58:47 -0400 (EDT) Received: from ORNLEXCHANGE.ornl.gov (ornlexchange1.ornl.gov [160.91.1.20]) by emroute2.ornl.gov (PMDF V6.2-1x9 #31038) with ESMTP id <0J2100BKXG9YOP@emroute2.ornl.gov> for linux-audit@redhat.com; Fri, 07 Jul 2006 10:58:46 -0400 (EDT) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com I have found that I can modify files that are being watched and audit not catch it (ie. no events are dispatched). When monitoring a file for all system calls, I can: echo "" > /file/to/watch or cat some_file > /file/to/watch without generating audit events. I assume this has to do with how the kernel handles re-direction. Is it possible to catch these modifications? Thanks, Steve