Re: Logging failed open() calls on /var/log/audit/audit.log

[Linda Knippers <linda.knippers@hp.com>]

Alexander Viro wrote:
> On Tue, Jun 27, 2006 at 05:36:43PM -0400, Linda Knippers wrote:
> 
>>Steve Grubb wrote:
>>
>>>On Tuesday 27 June 2006 17:15, Amy Griffis wrote:
>>>
>>>
>>>>If you would like to see a record in this case, you must add a watch
>>>>for /var/log/audit.
>>>
>>>
>>>I don't see a record watching this either.
>>
>>I think we're missing the directory lookup syscall(s) on watches
>>right now.
> 
> 
> Careful - that's one hell of a hot path.  Note that we'll get many of
> those for each syscall that does pathname resolution; moreover, when
> we hit dcache, we should be careful about blocking.

Maybe its not actually the lookup we need.  If I do this on RHEL4
I get an audit record for an open failure on /var/log/audit.
With the .34 lspp kernel and the 1.2.2 audit tools, I don't get
a record for a failed open, even though open seems to be registered
with the watch.

> [root@cert-e2 kernel]# /sbin/auditctl -l
> LIST_RULES: exit,always watch=/var/log/audit/audit.log (0x18) syscall=open,truncate,ftruncate,rename,mkdir,rmdir,creat,link,unlink,symlink,chmod,fchmod,chown,fchown,lchown
> LIST_RULES: exit,always watch=/var/log/audit (0xe) syscall=open,truncate,ftruncate,rename,mkdir,rmdir,creat,link,unlink,symlink,chmod,fchmod,chown,fchown,lchown

-- ljk