From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Example Date: Wed, 24 Sep 2008 07:34:20 -0400 Message-ID: <200809240734.21742.sgrubb@redhat.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: "Fulda, Paul (Space Technology)" List-Id: linux-audit@redhat.com On Tuesday 23 September 2008 12:18:27 Fulda, Paul (Space Technology) wrot= e: > Can someone give me an example of how to audit the "date" command in th= e > audit.rules file.=20 The "watch" style commands will not work. The audit system works at the=20 syscall level. So, under the hood, the audit system will place a rule on=20 execve, or open on your behalf. Neither of these are the actual syscall t= hat=20 fails. > I would like for it to report only failures for a user using the comman= d. > Root using the command would report nothing. =C2=A0I can get this worki= ng for file > watches but not for executables using strace is your friend. I ran a command that would fail and see something = like=20 this: write(3, "strace: exec: Permission denied\n"..., 32strace: exec: Permissi= on=20 denied ) =3D 32 close(3) =3D 0 munmap(0x7f17fc707000, 4096) =3D 0 exit_group(1) =20 So, we should be able to place a rule on exit_group. -a exit,always -S exit_group -F a0=3D1 -F auid>=3D500 But I'm really not sure this will give you good, quality results. You can= =20 experiment and see. But the audit system is at the syscall level and not = the=20 application level and that should always be taken into account. -Steve