* Audit watches on NFS mounts
@ 2016-10-20 14:42 Vaughn, Chad M
2016-10-20 15:37 ` Steve Grubb
0 siblings, 1 reply; 4+ messages in thread
From: Vaughn, Chad M @ 2016-10-20 14:42 UTC (permalink / raw)
To: Steve Grubb, linux-audit@redhat.com
I noticed a weird behavior. I NFS mount /usr/local on my Redhat machines.
If I put a watch for a directory in that NFS mount:
-w /usr/local/mywatchdir/ -p rwxa -F exit!=-ENODATA -F success!=1 -k watch
On Redhat 6.4, I don't see audit events when trying to remove or change files in that dir.
On Redhat 6.8, I do see the audit events when trying to remove or changes files in that dir.
Any ideas of possible features added to auditd between those releases? I would like to be able to speak to it for security audits.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Audit watches on NFS mounts
2016-10-20 14:42 Audit watches on NFS mounts Vaughn, Chad M
@ 2016-10-20 15:37 ` Steve Grubb
2016-10-20 16:10 ` EXTERNAL: " Vaughn, Chad M
0 siblings, 1 reply; 4+ messages in thread
From: Steve Grubb @ 2016-10-20 15:37 UTC (permalink / raw)
To: Vaughn, Chad M; +Cc: linux-audit@redhat.com
On Thursday, October 20, 2016 2:42:07 PM EDT Vaughn, Chad M wrote:
> I noticed a weird behavior. I NFS mount /usr/local on my Redhat machines.
>
> If I put a watch for a directory in that NFS mount:
>
> -w /usr/local/mywatchdir/ -p rwxa -F exit!=-ENODATA -F success!=1 -k watch
>
> On Redhat 6.4, I don't see audit events when trying to remove or change
> files in that dir. On Redhat 6.8, I do see the audit events when trying to
> remove or changes files in that dir.
>
> Any ideas of possible features added to auditd between those releases? I
> would like to be able to speak to it for security audits.
Auditd is just the collector. The events are generated by the kernel. So, it
would be a kernel change that may have allowed that. I don't know what was
changed or which version did it. I do know that in the past it was not
possible to audit nfs or fuse based file systems.
-Steve
^ permalink raw reply [flat|nested] 4+ messages in thread
* RE: EXTERNAL: Re: Audit watches on NFS mounts
2016-10-20 15:37 ` Steve Grubb
@ 2016-10-20 16:10 ` Vaughn, Chad M
2016-10-20 16:22 ` Steve Grubb
0 siblings, 1 reply; 4+ messages in thread
From: Vaughn, Chad M @ 2016-10-20 16:10 UTC (permalink / raw)
To: Steve Grubb; +Cc: linux-audit@redhat.com
Thanks for the quick response. That makes sense.
One other thing, on Redhat 6.4 if the watch dir does not exist, ie automount NFS, then auditd will bomb out and not even start.
On Redhat 6.8, it seems to not care and start up anyway (better). Kernel or Auditd?
-----Original Message-----
From: Steve Grubb [mailto:sgrubb@redhat.com]
Sent: Thursday, October 20, 2016 10:38 AM
To: Vaughn, Chad M (US) <chad.m.vaughn@lmco.com>
Cc: linux-audit@redhat.com
Subject: EXTERNAL: Re: Audit watches on NFS mounts
On Thursday, October 20, 2016 2:42:07 PM EDT Vaughn, Chad M wrote:
> I noticed a weird behavior. I NFS mount /usr/local on my Redhat machines.
>
> If I put a watch for a directory in that NFS mount:
>
> -w /usr/local/mywatchdir/ -p rwxa -F exit!=-ENODATA -F success!=1 -k
> watch
>
> On Redhat 6.4, I don't see audit events when trying to remove or
> change files in that dir. On Redhat 6.8, I do see the audit events
> when trying to remove or changes files in that dir.
>
> Any ideas of possible features added to auditd between those releases?
> I would like to be able to speak to it for security audits.
Auditd is just the collector. The events are generated by the kernel. So, it would be a kernel change that may have allowed that. I don't know what was changed or which version did it. I do know that in the past it was not possible to audit nfs or fuse based file systems.
-Steve
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: EXTERNAL: Re: Audit watches on NFS mounts
2016-10-20 16:10 ` EXTERNAL: " Vaughn, Chad M
@ 2016-10-20 16:22 ` Steve Grubb
0 siblings, 0 replies; 4+ messages in thread
From: Steve Grubb @ 2016-10-20 16:22 UTC (permalink / raw)
To: Vaughn, Chad M; +Cc: linux-audit@redhat.com
On Thursday, October 20, 2016 4:10:43 PM EDT Vaughn, Chad M wrote:
> Thanks for the quick response. That makes sense.
>
> One other thing, on Redhat 6.4 if the watch dir does not exist, ie automount
> NFS, then auditd will bomb out and not even start.
I have my doubts on this. What I would expect to happen is that the rules
being loaded by auditctl will get an error from the kernel and that is
displayed. If you do not have a rule to ignore errors then it will stop the
rule loading. Auditd itself should be up and running. The init script starts
auditd and then after its running, loads rules by auditctl.
> On Redhat 6.8, it seems to not care and start up anyway (better). Kernel or
> Auditd?
That was also a kernel change. Auditd is pretty much like a specialized
syslog.
-Steve
> -----Original Message-----
> From: Steve Grubb [mailto:sgrubb@redhat.com]
> Sent: Thursday, October 20, 2016 10:38 AM
> To: Vaughn, Chad M (US) <chad.m.vaughn@lmco.com>
> Cc: linux-audit@redhat.com
> Subject: EXTERNAL: Re: Audit watches on NFS mounts
>
> On Thursday, October 20, 2016 2:42:07 PM EDT Vaughn, Chad M wrote:
> > I noticed a weird behavior. I NFS mount /usr/local on my Redhat machines.
> >
> > If I put a watch for a directory in that NFS mount:
> >
> > -w /usr/local/mywatchdir/ -p rwxa -F exit!=-ENODATA -F success!=1 -k
> > watch
> >
> > On Redhat 6.4, I don't see audit events when trying to remove or
> > change files in that dir. On Redhat 6.8, I do see the audit events
> > when trying to remove or changes files in that dir.
> >
> > Any ideas of possible features added to auditd between those releases?
> > I would like to be able to speak to it for security audits.
>
> Auditd is just the collector. The events are generated by the kernel. So, it
> would be a kernel change that may have allowed that. I don't know what was
> changed or which version did it. I do know that in the past it was not
> possible to audit nfs or fuse based file systems.
>
> -Steve
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-10-20 16:22 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-10-20 14:42 Audit watches on NFS mounts Vaughn, Chad M
2016-10-20 15:37 ` Steve Grubb
2016-10-20 16:10 ` EXTERNAL: " Vaughn, Chad M
2016-10-20 16:22 ` Steve Grubb
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox