From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: exclude rule help Date: Thu, 25 Jun 2009 17:01:08 -0500 Message-ID: <1245967268.7681.8.camel@homeserver> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n5PM1O17011217 for ; Thu, 25 Jun 2009 18:01:24 -0400 Received: from mail.magitekltd.com (rrcs-24-242-137-197.sw.biz.rr.com [24.242.137.197]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n5PM19A1017925 for ; Thu, 25 Jun 2009 18:01:10 -0400 Received: from [24.242.137.194] (helo=[192.168.30.40]) by mail.magitekltd.com with esmtpsa (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1MJwya-00066x-PM for linux-audit@redhat.com; Thu, 25 Jun 2009 16:59:24 -0500 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Linux Audit List-Id: linux-audit@redhat.com I'm trying to create an audit rule to exclude all rsync actions when run by a process with a certain subject type (jcdx_fsbackup_t). Our policy allows the action to happen, however as a result we generate a ton of audit data on file access and recreation at the target point. Anyone have a good idea of how to discard all these events? Ideally the caller would send in a self-generated event such as "ryncing rick/src2/ to /temp-home" or similar. This is for a dedicated file backup procedure. Obviously I do not want to discard all rsync events, just when launched by our trusted program. Nor would I really want all that program's events discarded since I want it to be able to submit proactive events which summarize its behavior. Below are some event samples. Other ideas are welcome also if my approach is myopic/flawed. Thx, LCB. ---- node=develop.local.austin.rr.com type=PATH msg=audit(06/22/2009 15:05:37.017:901990) : item=0 name=rick/path1/path2/path3/k4jtCX inode=203842 dev=fd:04 mode=file,600 ouid=root ogid=unknown(1106) rdev=00:00 obj=siterep_u:object_r:user_home_t:s0 node=develop.local.austin.rr.com type=CWD msg=audit(06/22/2009 15:05:37.017:901990) : cwd=/temp_home node=develop.local.austin.rr.com type=SYSCALL msg=audit(06/22/2009 15:05:37.017:901990) : arch=x86_64 syscall=lchown success=yes exit=0 a0=7ffff2994e30 a1=1f7 a2=44c a3=1 items=1 ppid=5445 pid=5446 auid=rick uid=root gid=unknown(1106) euid=root suid=root fsuid=root egid=unknown(1106) sgid=unknown(1106) fsgid=unknown(1106) tty=pts2 ses=1 comm=rsync exe=/usr/bin/rsync subj=siterep_u:siterep_r:dx_fsbackup_t:s15:c0.c1023 key=perm_mod ... ---- node=develop.local.austin.rr.com type=PATH msg=audit(06/22/2009 15:05:37.017:901997) : item=3 name=rick/path1/path2/path3/f1 inode=203843 dev=fd:04 mode=file,444 ouid=unknown(503) ogid=unknown(1100) rdev=00:00 obj=system_u:object_r:user_home_t:s0 node=develop.local.austin.rr.com type=PATH msg=audit(06/22/2009 15:05:37.017:901997) : item=2 name=rick/path1/path2/path3/f2 inode=203843 dev=fd:04 mode=file,444 ouid=unknown(503) ogid=unknown(1100) rdev=00:00 obj=system_u:object_r:user_home_t:s0 node=develop.local.austin.rr.com type=PATH msg=audit(06/22/2009 15:05:37.017:901997) : item=1 name=rick/path1/path2/path3/d1 inode=203324 dev=fd:04 mode=dir,755 ouid=unknown(503) ogid=unknown(1100) rdev=00:00 obj=system_u:object_r:user_home_t:s0 node=develop.local.austin.rr.com type=PATH msg=audit(06/22/2009 15:05:37.017:901997) : item=0 name=rick/path1/path2/path3/d2 inode=203324 dev=fd:04 mode=dir,755 ouid=unknown(503) ogid=unknown(1100) rdev=00:00 obj=system_u:object_r:user_home_t:s0 node=develop.local.austin.rr.com type=CWD msg=audit(06/22/2009 15:05:37.017:901997) : cwd=/temp_home node=develop.local.austin.rr.com type=SYSCALL msg=audit(06/22/2009 15:05:37.017:901997) : arch=x86_64 syscall=rename success=yes exit=0 a0=7ffff2994e30 a1=7ffff2996e30 a2=0 a3=0 items=4 ppid=5445 pid=5446 auid=rick uid=root gid=unknown(1106) euid=root suid=root fsuid=root egid=unknown(1106) sgid=unknown(1106) fsgid=unknown(1106) tty=pts2 ses=1 comm=rsync exe=/usr/bin/rsync subj=siterep_u:siterep_r:dx_fsbackup_t:s15:c0.c1023 key=delete -- LC (Lenny) Bruzenak lenny@magitekltd.com