* RHEL 4, Auditing
@ 2010-07-20 12:04 List Quest
2010-07-20 12:24 ` Steve Grubb
0 siblings, 1 reply; 6+ messages in thread
From: List Quest @ 2010-07-20 12:04 UTC (permalink / raw)
To: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 348 bytes --]
Hi All;
I trying RHEL 4.x series auditing.
Example:
Audit version: audit-1.0.15-3.EL4
-w /root -p w
config line added to audit.rules; but this config watch only "/root"
directory writes. Do not watch "/root/Desktop", "/root/test", etc...
I can't recusive directory watch; like audit version audit-1.7.17-3
How this?
Thank you
Best Regards.
[-- Attachment #1.2: Type: text/html, Size: 442 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: RHEL 4, Auditing
2010-07-20 12:04 RHEL 4, Auditing List Quest
@ 2010-07-20 12:24 ` Steve Grubb
2010-07-20 12:53 ` List Quest
0 siblings, 1 reply; 6+ messages in thread
From: Steve Grubb @ 2010-07-20 12:24 UTC (permalink / raw)
To: linux-audit
On Tuesday, July 20, 2010 08:04:02 am List Quest wrote:
> I trying RHEL 4.x series auditing.
>
> Example:
> Audit version: audit-1.0.15-3.EL4
>
> -w /root -p w
>
> config line added to audit.rules; but this config watch only "/root"
> directory writes. Do not watch "/root/Desktop", "/root/test", etc...
>
> I can't recusive directory watch; like audit version audit-1.7.17-3
>
> How this?
That is correct. The first iteration of the audit system has some limitations
that were fixed over time. For example, another thing you cannot do on the
older kernels is add a key to syscall rules.
-Steve
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: RHEL 4, Auditing
2010-07-20 12:24 ` Steve Grubb
@ 2010-07-20 12:53 ` List Quest
2010-07-20 13:00 ` Steve Grubb
0 siblings, 1 reply; 6+ messages in thread
From: List Quest @ 2010-07-20 12:53 UTC (permalink / raw)
To: Steve Grubb; +Cc: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 925 bytes --]
Hi;
Ok. For example watch /root directory and subdirectories:
I can only -> Scan /root directory recursive(find /root/ -type d); and add
to audit.rules file all result lines.
This technic true?
Best Regards
On Tue, Jul 20, 2010 at 3:24 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> On Tuesday, July 20, 2010 08:04:02 am List Quest wrote:
> > I trying RHEL 4.x series auditing.
> >
> > Example:
> > Audit version: audit-1.0.15-3.EL4
> >
> > -w /root -p w
> >
> > config line added to audit.rules; but this config watch only "/root"
> > directory writes. Do not watch "/root/Desktop", "/root/test", etc...
> >
> > I can't recusive directory watch; like audit version audit-1.7.17-3
> >
> > How this?
>
> That is correct. The first iteration of the audit system has some
> limitations
> that were fixed over time. For example, another thing you cannot do on the
> older kernels is add a key to syscall rules.
>
> -Steve
>
[-- Attachment #1.2: Type: text/html, Size: 1418 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: RHEL 4, Auditing
2010-07-20 12:53 ` List Quest
@ 2010-07-20 13:00 ` Steve Grubb
2010-07-20 13:43 ` List Quest
2010-07-20 13:54 ` List Quest
0 siblings, 2 replies; 6+ messages in thread
From: Steve Grubb @ 2010-07-20 13:00 UTC (permalink / raw)
To: List Quest; +Cc: linux-audit
On Tuesday, July 20, 2010 08:53:43 am List Quest wrote:
> For example watch /root directory and subdirectories:
>
> I can only -> Scan /root directory recursive(find root -type d); and add
> to audit.rules file all result lines.
>
> This technic true?
Yes, you can do that.
-Steve
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: RHEL 4, Auditing
2010-07-20 13:00 ` Steve Grubb
@ 2010-07-20 13:43 ` List Quest
2010-07-20 13:54 ` List Quest
1 sibling, 0 replies; 6+ messages in thread
From: List Quest @ 2010-07-20 13:43 UTC (permalink / raw)
To: Steve Grubb; +Cc: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 428 bytes --]
Hi,
Thank you for your reply.
Best Regards.
On Tue, Jul 20, 2010 at 4:00 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> On Tuesday, July 20, 2010 08:53:43 am List Quest wrote:
> > For example watch /root directory and subdirectories:
> >
> > I can only -> Scan /root directory recursive(find root -type d); and add
> > to audit.rules file all result lines.
> >
> > This technic true?
>
> Yes, you can do that.
>
> -Steve
>
[-- Attachment #1.2: Type: text/html, Size: 808 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: RHEL 4, Auditing
2010-07-20 13:00 ` Steve Grubb
2010-07-20 13:43 ` List Quest
@ 2010-07-20 13:54 ` List Quest
1 sibling, 0 replies; 6+ messages in thread
From: List Quest @ 2010-07-20 13:54 UTC (permalink / raw)
To: Steve Grubb; +Cc: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 879 bytes --]
Hi;
Second lack for configuration.
RHEL 5.x can configure one directory watch; to all permissions and use key
name.
Example:
-w /root -p w -k writing
-w /root -p r -k reading
...
But, RHEL 4.x can't this rule. For one directory watch, only one line rule
accepting.
RHEL 4.x can't all permisions watch, and use key functionality.
Error: ( Error sending watch insert request (File exists) )
This subject true? And, how can i fix this issue?
Thank you, and sorry my serial posts.
Best Regards.
On Tue, Jul 20, 2010 at 4:00 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> On Tuesday, July 20, 2010 08:53:43 am List Quest wrote:
> > For example watch /root directory and subdirectories:
> >
> > I can only -> Scan /root directory recursive(find root -type d); and add
> > to audit.rules file all result lines.
> >
> > This technic true?
>
> Yes, you can do that.
>
> -Steve
>
[-- Attachment #1.2: Type: text/html, Size: 1315 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2010-07-20 13:54 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-07-20 12:04 RHEL 4, Auditing List Quest
2010-07-20 12:24 ` Steve Grubb
2010-07-20 12:53 ` List Quest
2010-07-20 13:00 ` Steve Grubb
2010-07-20 13:43 ` List Quest
2010-07-20 13:54 ` List Quest
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox