From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: path watcher Date: Fri, 12 Sep 2014 13:35:48 -0400 Message-ID: <2095364.4DrZPs0qDA@x2> References: <53F7624C.2000903@oracle.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <53F7624C.2000903@oracle.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com Hello, I had hoped some kernel guys would have jumped in here to answer...but I'll take a stab at it. On Friday, August 22, 2014 04:31:24 PM John Haxby wrote: > We have an internal group auditing updates to files but who would like > to be able to monitor the actual modification rather than the possible > intent to modify. That would be a nice addition. > The example they gave is that some program opens a file > O_WRONLY|O_APPEND but in most cases it does not subsequently write to > the file. For them, the usual auditctl -p path -w wa causes lots of > false positives. I have asked some problematic apps to open readonly and then change flags when they decide they need to write. Some people comply, others can't believe I even asked them to do it. > Historically, I know, that -w wa is triggered by the open(2) flags > rather than actual modifications because "[t]he read & write syscalls > are omitted from this set since they would overwhelm the logs." Reading > this again now, it looks a little specious as it seems quite easy to > overwhelm the logs anyway. > > Is there any reason why a file watcher should not use the fsnotify > FS_ACCESS/MODIFY/ATTRIB masks before I go haring off to try to implement > that? I don't know the particulars. But for auditing purposes, we'd only want 1 event no matter how many times they wrote. If the w/r flags could be cleaned up to be accurate and not signal just the intent, I think that would be good. However, I am sure there are tricky corner cases such as mmapped files that also need to be accounted for. Steve