Re: Audit config for NISPOM req's

[Steve Grubb <sgrubb@redhat.com>]

On Friday 22 December 2006 10:08, Curtas, Anthony R. wrote:
> One thing that still confuses me is how "possible" is implemented.

Possible means to collect the information at entry in case its needed later. 
Rules with possible will never trigger an event, they simply tell it to 
collect the information. A watch or SE Linux AVC would actually use the 
information collected.

> From what I've read in the documentation, it looks like if you set a rule
> for entry,possible -- the audit system waits until a file watch is thrown,
> then it writes the event.  Do I have this right?  

Yes.

> If I always want to see when /etc/shadow is opened:
>
> -w /etc/shadow -rwxa
> -a entry,possible -S open

That would be opened for write or execute.

> Will that work?  And if I understand the mechanism correctly, that would
> log an open of ANY file that has a watch on it?

Not quite. It will collect the information for any open, but only emit an 
event when shadow is opened for write or execute.

> One last thing, if I only want unsuccessful open attempts on the watch
> files, would this work?
> -a entry,possible -S open -F success!=1

It should collect the information for later use. If you wanted all 
unsuccessful opens, I'd rewrite as:

-a exit,always -S open -F success!=1

-Steve