Audit and file watching

Audit and file watching

[Steve]

I have been using Audit's file watching ability to monitor when files 
are opened.  I decided to also try to monitor the deletion of files, so 
I told audit to watch for all syscalls pertaining to a particular file. 
   I then tried opening the file, it worked as before.  Then I tried to 
delete the file using 'rm /tmp/test.c' the file was deleted from the 
filesystem, but audit only showed two syscalls being performed: lstat64 
and access.  Audit also sent a message saying:

... audit updated rules specifying watch="/tmp/test.c" ...

lstat64 and access can not delete files on the filesystem, can they?

I expected to see unlink...

Any ideas?

Steve














Jun 14 13:21:06 otslab11 user_actions[8035]: type=1300, payload size=279
Jun 14 13:21:06 otslab11 user_actions[8035]: 
data="audit(1150305665.265:679): arch=40000003 syscall=196 success=yes 
exit=0 a0=bf8c7c49 a1=bf8c6fbc a2=8f1ff4 a3=bf8c7c49 items=1 ppid=7838 
pid=8043 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 
fsgid=0 tty=pts2 comm="rm" exe="/bin/rm" 
subj=user_u:system_r:unconfined_t:s0"
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1307, payload size=43
Jun 14 13:21:06 otslab11 user_actions[8035]: 
data="audit(1150305665.265:679):  cwd="/tmp/test""
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1302, payload size=143
Jun 14 13:21:06 otslab11 user_actions[8035]: 
data="audit(1150305665.265:679): item=0 name="/tmp/test.c" inode=5358237 
dev=03:02 mode=0100644 ouid=0 ogid=0 rdev=00:00 
obj=user_u:object_r:tmp_t:s0"
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1300, payload size=264
Jun 14 13:21:06 otslab11 user_actions[8035]: 
data="audit(1150305665.265:680): arch=40000003 syscall=33 success=yes 
exit=0 a0=bf8c7c49 a1=2 a2=8f1ff4 a3=2 items=1 ppid=7838 pid=8043 
auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 
tty=pts2 comm="rm" exe="/bin/rm" subj=user_u:system_r:unconfined_t:s0"
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1307, payload size=43
Jun 14 13:21:06 otslab11 user_actions[8035]: 
data="audit(1150305665.265:680):  cwd="/tmp/test""
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1302, payload size=143
Jun 14 13:21:06 otslab11 user_actions[8035]: 
data="audit(1150305665.265:680): item=0 name="/tmp/test.c" inode=5358237 
dev=03:02 mode=0100644 ouid=0 ogid=0 rdev=00:00 
obj=user_u:object_r:tmp_t:s0"
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1305, payload size=113
Jun 14 13:21:06 otslab11 user_actions[8035]: 
data="audit(1150305665.265:681): audit updated rules specifying 
watch="/tmp/test.c" with dev=4294967295 ino=4294967295 "

Re: Audit and file watching

[Steve]

> I expected to see unlink...
> 
> Any ideas?

This may be a result of the discussion posted previously:

[PATCH git] fix missing records when watched files removed

If so, please ignore this.

Steve

Re: Audit and file watching

[Amy Griffis]

Steve wrote:     [Wed Jun 14 2006, 01:46:59PM EDT]
> >I expected to see unlink...
> >
> >Any ideas?
> 
> This may be a result of the discussion posted previously:
> 
> [PATCH git] fix missing records when watched files removed
> 
> If so, please ignore this.

Yes.  If you don't have that patch, you won't see the unlink event.