Re: Current capabilities

Steve Grubb
2006-12-13T23:41:16Z

On Wednesday 13 December 2006 18:16, Michael W Folsom wrote:
> 1) If someone tries to access an object (file, directory, program) that
> they don't have rights to the event needs to be recorded

-a always,exit -S open,opendir,execve -F exit=-13

This does it for 3 common syscalls. You can do it for any syscall you want.
You can use strace to figure out the syscalls you want.

> 2) if someone logs into a system and su's to another user or series of
> users their actions need to be traceable to the original login user's
> id

It does this. There is a process attribute, loginuid, that keeps track of
this. The audit events have it as the auid field. We've already preconfigured
RHEL4/5 and FC4->rawhide to handle this.

-Steve