From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael C Thompson <thompsmc@us.ibm.com>
Subject: Re: File watching
Date: Tue, 20 Jun 2006 13:55:41 -0500
Message-ID: <449844AD.4010804@us.ibm.com>
References: <4498360A.7090807@ornl.gov>	<20060620181024.GA31078@arlut.utexas.edu>	<1150827779.19484.7.camel@localhost.localdomain>	<44983F25.5010801@ornl.gov>	<1150828819.19484.14.camel@localhost.localdomain>
	<449843F5.2080503@ornl.gov>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32])
	by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id
	k5KIu3MW018152
	for <linux-audit@redhat.com>; Tue, 20 Jun 2006 14:56:03 -0400
Received: from e2.ny.us.ibm.com (e2.ny.us.ibm.com [32.97.182.142])
	by mx3.redhat.com (8.13.1/8.13.1) with ESMTP id k5KItvPn004593
	for <linux-audit@redhat.com>; Tue, 20 Jun 2006 14:55:57 -0400
Received: from d01relay04.pok.ibm.com (d01relay04.pok.ibm.com [9.56.227.236])
	by e2.ny.us.ibm.com (8.12.11.20060308/8.12.11) with ESMTP id
	k5KItp63029063
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <linux-audit@redhat.com>; Tue, 20 Jun 2006 14:55:52 -0400
Received: from d01av03.pok.ibm.com (d01av03.pok.ibm.com [9.56.224.217])
	by d01relay04.pok.ibm.com (8.13.6/NCO/VER7.0) with ESMTP id
	k5KItpnE134658
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <linux-audit@redhat.com>; Tue, 20 Jun 2006 14:55:51 -0400
Received: from d01av03.pok.ibm.com (loopback [127.0.0.1])
	by d01av03.pok.ibm.com (8.12.11.20060308/8.13.3) with ESMTP id
	k5KItpZp008570
	for <linux-audit@redhat.com>; Tue, 20 Jun 2006 14:55:51 -0400
In-Reply-To: <449843F5.2080503@ornl.gov>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Steve <m6x@ornl.gov>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

Steve wrote:
>>> Is it possible to tell if a file was opened read/write or read-only 
>>> from the events generated by audit?
> 
>> The record does record syscall arguments, however, so perhaps you could
>> analyze a1= (I believe this is the argument that passes flags), and
>> figure out with what flags open() was called with.
> 
> I performed an open on a file twice, the first is when the user had 
> read/write privileges to the file and in the second the user only has 
> read permissions.  These were the a# values from the events, respectively:
> 
> a0=bfe6ac25 a1=8000 a2=0 a3=8000
> 
> a0=bfd25b55 a1=8000 a2=0 a3=8000
> 
> I'm not sure how to analyze that...

In both cases, a1 (the flags) is O_RDONLY (000 octal, 0x0 hex) and 
O_LARGEFILE (0100000 octal, 0x8000 hex).

So you were opened as read-only. You can't determine the level of access 
the user has from the above, although you should be able to infer some 
information about it form the entire record.

Mike