Audit with path exception rule

Audit with path exception rule

[Ameel Kamboh]

[-- Attachment #1.1: Type: text/plain, Size: 744 bytes --]

I would like to audit the file system for anyone creating new files
However I would like to exclude a directory from the watch list.

Here is the sample I have:

#3.     create/Remove any files
-a exit,always -S creat  -F path!=/var/myApp   <--- line 21
-a exit,always -S unlink -F path!=/var/myApp

This is giving me the following error:

auditctl -R test.rules
No rules
AUDIT_STATUS: enabled=1 flag=1 pid=3413 rate_limit=0 backlog_limit=1024
lost=0 backlog=0
Error sending add rule data request (Invalid argument)
There was an error in line 21 of test.rules

Ameel Kamboh
SIP Core Network and Security 
Phone: 972.685.4922 (esn 445-4922)
Mobile: 978-590-2280
SIP: akamboh@techtrial.com
email: akamboh@nortel.com




[-- Attachment #1.2: Type: text/html, Size: 2472 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Audit with path exception rule

[Steve Grubb]

On Monday 23 July 2007 11:25:22 am Ameel Kamboh wrote:
> I would like to audit the file system for anyone creating new files
> However I would like to exclude a directory from the watch list.
>
> Here is the sample I have:
>
> #3.     create/Remove any files
> -a exit,always -S creat  -F path!=/var/myApp   <--- line 21
> -a exit,always -S unlink -F path!=/var/myApp

I was hoping one of the kernel people was going to jump in with an answer 
here. I have a feeling that the kernel doesn't allow it. I think it would be 
trivial to patch the kernel to allow this and we should. The rule you are 
trying to express seems reasonable to me.

-Steve

Re: Audit with path exception rule

[Alexander Viro]

On Tue, Jul 24, 2007 at 03:47:59PM -0400, Steve Grubb wrote:
> On Monday 23 July 2007 11:25:22 am Ameel Kamboh wrote:
> > I would like to audit the file system for anyone creating new files
> > However I would like to exclude a directory from the watch list.
> >
> > Here is the sample I have:
> >
> > #3.     create/Remove any files
> > -a exit,always -S creat  -F path!=/var/myApp   <--- line 21
> > -a exit,always -S unlink -F path!=/var/myApp
> 
> I was hoping one of the kernel people was going to jump in with an answer 
> here. I have a feeling that the kernel doesn't allow it. I think it would be 
> trivial to patch the kernel to allow this and we should. The rule you are 
> trying to express seems reasonable to me.

The problem with that is simple - for that kind of rules we lose hash-based
overhead reduction we have for watches.

Basically, we distribute AUDIT_WATCH rules into a bunch of lists, by
hash(inumber(watched object)).  At match time we can skip most of them
immediately, by not walking every list.

Negative rules like that would have to go into "the rest" list and its
length is rather sensitive for overhead...