From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Ameel Kamboh" Subject: Audit with path exception rule Date: Mon, 23 Jul 2007 10:25:22 -0500 Message-ID: <95470FF653FF324C8171194A81299CE01519EEA1@zrc2hxm2.corp.nortel.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0359311464==" Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l6NFXRUk019786 for ; Mon, 23 Jul 2007 11:33:27 -0400 Received: from zrtps0kp.nortel.com (zrtps0kp.nortel.com [47.140.192.56]) by mx1.redhat.com (8.13.1/8.13.1) with ESMTP id l6NFXJOd027754 for ; Mon, 23 Jul 2007 11:33:20 -0400 Received: from zrc2hxm2.corp.nortel.com (zrc2hxm2.corp.nortel.com [47.103.123.73]) by zrtps0kp.nortel.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id l6NFPhm24006 for ; Mon, 23 Jul 2007 15:25:43 GMT Content-class: urn:content-classes:message List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com This is a multi-part message in MIME format. --===============0359311464== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C7CD3D.AFFEE64C" This is a multi-part message in MIME format. ------_=_NextPart_001_01C7CD3D.AFFEE64C Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I would like to audit the file system for anyone creating new files However I would like to exclude a directory from the watch list. Here is the sample I have: #3. create/Remove any files -a exit,always -S creat -F path!=3D/var/myApp <--- line 21 -a exit,always -S unlink -F path!=3D/var/myApp This is giving me the following error: auditctl -R test.rules No rules AUDIT_STATUS: enabled=3D1 flag=3D1 pid=3D3413 rate_limit=3D0 = backlog_limit=3D1024 lost=3D0 backlog=3D0 Error sending add rule data request (Invalid argument) There was an error in line 21 of test.rules Ameel Kamboh SIP Core Network and Security=20 Phone: 972.685.4922 (esn 445-4922) Mobile: 978-590-2280 SIP: akamboh@techtrial.com email: akamboh@nortel.com ------_=_NextPart_001_01C7CD3D.AFFEE64C Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Audit with path exception rule

I would like to audit the file system = for anyone creating new files
However I would like to exclude a = directory from the watch list.

Here is the sample I have:

#3.     = create/Remove any files
-a exit,always -S creat  -F = path!=3D/var/myApp   <--- line 21
-a exit,always -S unlink -F = path!=3D/var/myApp

This is giving me the following = error:

auditctl -R test.rules
No rules
AUDIT_STATUS: enabled=3D1 flag=3D1 = pid=3D3413 rate_limit=3D0 backlog_limit=3D1024 lost=3D0 = backlog=3D0
Error sending add rule data request = (Invalid argument)
There was an error in line 21 of = test.rules

Ameel = Kamboh
SIP Core Network and Security =
Phone: 972.685.4922 = (esn 445-4922)
Mobile: = 978-590-2280
SIP: = akamboh@techtrial.com
email: = akamboh@nortel.com



------_=_NextPart_001_01C7CD3D.AFFEE64C-- --===============0359311464== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0359311464==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Audit with path exception rule Date: Tue, 24 Jul 2007 15:47:59 -0400 Message-ID: <200707241548.00142.sgrubb@redhat.com> References: <95470FF653FF324C8171194A81299CE01519EEA1@zrc2hxm2.corp.nortel.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <95470FF653FF324C8171194A81299CE01519EEA1@zrc2hxm2.corp.nortel.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com, Alexander Viro List-Id: linux-audit@redhat.com On Monday 23 July 2007 11:25:22 am Ameel Kamboh wrote: > I would like to audit the file system for anyone creating new files > However I would like to exclude a directory from the watch list. > > Here is the sample I have: > > #3. create/Remove any files > -a exit,always -S creat -F path!=/var/myApp <--- line 21 > -a exit,always -S unlink -F path!=/var/myApp I was hoping one of the kernel people was going to jump in with an answer here. I have a feeling that the kernel doesn't allow it. I think it would be trivial to patch the kernel to allow this and we should. The rule you are trying to express seems reasonable to me. -Steve From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alexander Viro Subject: Re: Audit with path exception rule Date: Tue, 14 Aug 2007 15:12:25 -0400 Message-ID: <20070814191225.GA14077@devserv.devel.redhat.com> References: <95470FF653FF324C8171194A81299CE01519EEA1@zrc2hxm2.corp.nortel.com> <200707241548.00142.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <200707241548.00142.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tue, Jul 24, 2007 at 03:47:59PM -0400, Steve Grubb wrote: > On Monday 23 July 2007 11:25:22 am Ameel Kamboh wrote: > > I would like to audit the file system for anyone creating new files > > However I would like to exclude a directory from the watch list. > > > > Here is the sample I have: > > > > #3. create/Remove any files > > -a exit,always -S creat -F path!=/var/myApp <--- line 21 > > -a exit,always -S unlink -F path!=/var/myApp > > I was hoping one of the kernel people was going to jump in with an answer > here. I have a feeling that the kernel doesn't allow it. I think it would be > trivial to patch the kernel to allow this and we should. The rule you are > trying to express seems reasonable to me. The problem with that is simple - for that kind of rules we lose hash-based overhead reduction we have for watches. Basically, we distribute AUDIT_WATCH rules into a bunch of lists, by hash(inumber(watched object)). At match time we can skip most of them immediately, by not walking every list. Negative rules like that would have to go into "the rest" list and its length is rather sensitive for overhead...