log deletion of directories?

log deletion of directories?

[Brian LaMere]

[-- Attachment #1.1: Type: text/plain, Size: 1009 bytes --]

Trying to find what is deleting a directory (/tmp/xauth).  Thought I'd
start with the basics, and just putting a watch on it.

[bel@comsup]:/etc/audit > auditctl -w /testdir/checkdir -p rwxa -k
missingfiles
[bel@comsup]:/etc/audit > auditctl -l|grep missing
LIST_RULES: exit,always dir=/testdir/checkdir (0x11) perm=rwxa
key=missingfiles
[bel@comsup]:/etc/audit > ausearch -k missingfiles
<no matches>
[bel@comsup]:/etc/audit > rmdir /testdir/checkdir 
[bel@comsup]:/etc/audit > ausearch -k missingfiles
<no matches>
[bel@comsup]:/etc/audit > auditctl -w /testdir/checkfile -p wrxa -k
missingfiles
[bel@comsup]:/etc/audit > rm /testdir/checkfile
[bel@comsup]:/etc/audit > ausearch -k missingfiles
----
(lots of text here)

Any suggestions on how to get it to do for a directory what it's doing
for the file?  I don't want to watch /tmp for adds/removes obviously;
that would be silly.  It is indeed a *directory* (regardless whether the
directory contents show up) that I want to watch.

Thanks,
Brian LaMere

[-- Attachment #1.2: Type: text/html, Size: 1456 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: log deletion of directories?

[Steve Grubb]

On Friday 05 September 2008 19:34:24 Brian LaMere wrote:
> Trying to find what is deleting a directory (/tmp/xauth).  Thought I'd
> start with the basics, and just putting a watch on it.
>
> [bel@comsup]:/etc/audit > auditctl -w /testdir/checkdir -p rwxa -k
> missingfiles

This rule translates to:

auditctl -a always,exit -F dir=/testdir/checkdir -F perm=rwxa -k missingfiles

This watches any *files* in the /testdir/checkdir directory and it's 
subdirectories. To check the directory itself, you need to use the "path" 
field to point at the directory and not the files it contains.

[root ~]# mkdir temp
[root ~]# auditctl -a exit,always -F path=/root/temp -F perm=wa -k rm
[root ~]# rmdir temp/
[root ~]# ausearch --start recent -k rm
time->Sat Sep  6 18:30:10 2008
node=127.0.0.1 type=PATH msg=audit(1220740210.750:906): item=1 name="temp/" 
inode=13664599 dev=08:08 mode=040755 ouid=0 ogid=0 rdev=00:00 
obj=unconfined_u:object_r:user_home_t:s0 
node=127.0.0.1 type=PATH msg=audit(1220740210.750:906): item=0  name="/root" 
inode=13664257 dev=08:08 mode=040750 ouid=0 ogid=0 rdev=00:00 
obj=system_u:object_r:user_home_dir_t:s0 
node=127.0.0.1 type=CWD msg=audit(1220740210.750:906):  cwd="/root" 
node=127.0.0.1 type=SYSCALL msg=audit(1220740210.750:906): arch=c000003e 
syscall=84 success=yes exit=0 a0=7fff777e189e a1=2 a2=3960b66114 
a3=3960b67a70 items=2 ppid=3621 pid=3940 auid=4325 uid=0 gid=0 euid=0 suid=0 
fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=2 comm="rmdir" exe="/bin/rmdir" 
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="rm" 


-Steve