From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: questions about auditing on a new RH 6 box Date: Fri, 14 Jan 2011 14:12:41 -0500 Message-ID: <201101141412.41315.sgrubb@redhat.com> References: <1295026506.2041.19.camel@lcb> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Friday, January 14, 2011 01:10:09 pm Tangren, Bill wrote: > I think that some of this is capturing that I was using the tail command to > capture some of the logs to email to myself to post here. Obviously that > isn't typical, but hopefully there is some useful information here. Oh, > and my uid and gid are both 500. This is coming from: -a exit,always -F arch=b64 -S mknod -S acct -S swapon -S sethostname -Fsuccess=0 -F auid=0 -F exit!=-11 Which says, audit mknod calls that are not successful and who's errno does not equal EAGAIN for anyone that logged in as root. -a exit,always -F arch=b64 -S mknod -S acct -S swapon -S sethostname -F success=0 -F auid=-1 -F exit!=-11 Which says audit mknod calls that are not successful, its a system event meaning not coming from a user session, and the exit code is not EAGAIN. #Ensure that failed attempts at using the following system calls are audited -a exit,always -F arch=b64 -S mknod -S acct -S swapon -S sethostname -F success=1 -F exit!=-11 Which says audit mknod calls that are successful and the exit code is not EAGAIN. Are you sure this is what you intended? -Steve