From mboxrd@z Thu Jan 1 00:00:00 1970 From: Amy Griffis Subject: Re: Bypassing audit's file watches Date: Mon, 10 Jul 2006 18:31:32 -0400 Message-ID: <20060710223132.GA16657@dill.zko.hp.com> References: <44AE76A2.9050205@ornl.gov> <20060708020002.GA5350@dill.zko.hp.com> <1152544584.13544.11.camel@localhost.localdomain> <44AE76A2.9050205@ornl.gov> <20060708020002.GA5350@dill.zko.hp.com> <44B23ACA.10409@ornl.gov> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k6AMWZcf028609 for ; Mon, 10 Jul 2006 18:32:35 -0400 Received: from atlrel7.hp.com (atlrel7.hp.com [156.153.255.213]) by mx1.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k6AMWYeQ030149 for ; Mon, 10 Jul 2006 18:32:34 -0400 Content-Disposition: inline In-Reply-To: <1152544584.13544.11.camel@localhost.localdomain> <44B23ACA.10409@ornl.gov> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve , "Timothy R. Chavez" Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com Steve wrote: [Mon Jul 10 2006, 07:32:26AM EDT] > Amy Griffis wrote: > >Steve wrote: [Fri Jul 07 2006, 10:58:42AM EDT] > >>I have found that I can modify files that are being watched and audit > >>not catch it (ie. no events are dispatched). When monitoring a file for > >>all system calls, I can: > >> > >>echo "" > /file/to/watch > >> > >>or > >> > >>cat some_file > /file/to/watch > >> > >>without generating audit events. > > > >Are you seeing the open and not the write, or no records at all? > >If you are missing events for open() calls, please let us know since > >that would be a bug (versus a lacking feature). > > I am not seeing the open() or any other syscall records. The problem you're seeing is with audit's data collection during open() calls. When open() is called with O_CREAT, but the file exists, audit collects the wrong inode number for the call. I'll try to come up with a decent patch to fix this. Timothy R. Chavez wrote: [Mon Jul 10 2006, 11:16:23AM EDT] > I think this is a bug. We see audit records for a failed attempt at > writing a file (e.g. chmod -w foo, echo "bar" > foo) via redirection, > but not otherwise. This is interesting. You see a record for the failed attempt because the shell tries again without the O_CREAT flag. >>From strace: open("/tmp/foo", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = -1 EACCES (Permission denied) open("/tmp/foo", O_WRONLY|O_TRUNC|O_LARGEFILE) = -1 EACCES (Permission denied) So you should actually see 2 open() records in the failure case. Amy