From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Matching close() system calls Date: Thu, 15 Mar 2018 18:34:10 +0100 Message-ID: <20180315183410.5292c6af@ivy-bridge> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Kerem Aksu Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Wed, 14 Mar 2018 15:51:44 +0300 Kerem Aksu wrote: > Hello, > > I am trying to trace files by using this rule : > "-a always,exit -F arch=b64 -S read,write,open,close -k file_op" > > I can trace open() system calls with the "type=path" log occurred > with the same ID as the open() system call. I can learn which file is > opened by that open() system call. If open returns a non-negative number, then that is the descriptor. You'll need to match that descriptor as an argument to the other syscalls for the same pid. You might need to watch exit_group also since a program exiting closes all descriptors. And also you'll need to check flags set by open and fcntl to see if CLOEXEC is being set. > But when it comes to other system calls I am unable to learn which > file is read, wrote or closed. This is implicit by referencing the descriptor. > I tried to match arguments passed to system calls (a[0..3]) but those > are different than the arguments defined in linux man pages. I might > misunderstand these arguments. No, they are pretty much the same. > How can I match these or any other (file) system calls with the files > that they used onto. > And when does a "type=PATH" log occurs? You'll probably need to write a program using auparse to save the descriptor from an open or openat and then output the information you need as a custom program. -Steve