From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: A question about the directory watch in audit_tree.c in kernel Date: Wed, 21 May 2008 11:03:34 -0400 Message-ID: <200805211103.34938.sgrubb@redhat.com> References: <001701c8ba16$77c11ad0$2e8da70a@fnste3fa5f55c4> <1211285172.20187.20.camel@pc070168.northgrum.com> <002501c8bae4$b3491480$2e8da70a@fnste3fa5f55c4> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <002501c8bae4$b3491480$2e8da70a@fnste3fa5f55c4> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: zhangxiliang Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday 20 May 2008 21:47:59 zhangxiliang wrote: > Sorry, I think my idea may be not express correctly. A example as follows: > 1, mkdir test > 2, touch test.c > 3, auditctl -w /home/test -k 11 > 4, auditctl -w /home/test.c -k 11 And then what did you do to create these records? > My question is why no information will be output by kernel hook funtion? What is missing? I can't tell what commands you run and what you expected to be output by the kernel. > Correct me if I am wrong, I think when watch a directory, kernel-audit can > also supply more information by kernel hook funtion What other information do you need? Also, note that -w rules are legacy for compatibility with RHEL4 kernel. They are used to express simple ideas like watch this file or directory subtree. If you want tight control over what you are auditing, you should use the syscall audit format where you can express more details about what you wanted to trigger on. IOW, you can express that you want changes to a directory itself rather than the files in the directory. -Steve