From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve <m6x@ornl.gov>
Subject: Re: File watching
Date: Tue, 20 Jun 2006 14:52:37 -0400
Message-ID: <449843F5.2080503@ornl.gov>
References: <4498360A.7090807@ornl.gov>
	<20060620181024.GA31078@arlut.utexas.edu>
	<1150827779.19484.7.camel@localhost.localdomain>
	<44983F25.5010801@ornl.gov>
	<1150828819.19484.14.camel@localhost.localdomain>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31])
	by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id
	k5KIqjYl017026
	for <linux-audit@redhat.com>; Tue, 20 Jun 2006 14:52:45 -0400
Received: from emroute1.ornl.gov (emroute1.ornl.gov [160.91.4.119])
	by mx1.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id
	k5KIqhXT028033
	for <linux-audit@redhat.com>; Tue, 20 Jun 2006 14:52:43 -0400
Received: from emroute1.ornl.gov (localhost [127.0.0.1])
	by emroute1.ornl.gov (PMDF V6.2-1x9 #31038)
	with ESMTP id <0J1600MQA9RTZ4@emroute1.ornl.gov> for
	linux-audit@redhat.com; Tue, 20 Jun 2006 14:52:42 -0400 (EDT)
Received: from ORNLEXCHANGE.ornl.gov (ornlexchange2.ornl.gov [160.91.1.22])
	by emroute1.ornl.gov (PMDF V6.2-1x9 #31038)
	with ESMTP id <0J1600C2L9RT8S@emroute1.ornl.gov> for
	linux-audit@redhat.com; Tue, 20 Jun 2006 14:52:41 -0400 (EDT)
In-reply-to: <1150828819.19484.14.camel@localhost.localdomain>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

>> Is it possible to tell if a file was opened read/write or read-only from 
>> the events generated by audit?

> The record does record syscall arguments, however, so perhaps you could
> analyze a1= (I believe this is the argument that passes flags), and
> figure out with what flags open() was called with.

I performed an open on a file twice, the first is when the user had 
read/write privileges to the file and in the second the user only has 
read permissions.  These were the a# values from the events, respectively:

a0=bfe6ac25 a1=8000 a2=0 a3=8000

a0=bfd25b55 a1=8000 a2=0 a3=8000

I'm not sure how to analyze that...