From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: Auditing a program use but not what it is doing
Date: Wed, 12 Feb 2020 08:53:24 -0500
Message-ID: <4711138.QvFmgxA1yv@x2>
References: <5F4EE10832231F4F921A255C1D95429829F549@DEERLM99EX7MSX.ww931.my-it-solutions.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <5F4EE10832231F4F921A255C1D95429829F549@DEERLM99EX7MSX.ww931.my-it-solutions.net>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
Cc: "MAUPERTUIS, PHILIPPE" <philippe.maupertuis@equensworldline.com>
List-Id: linux-audit@redhat.com

On Wednesday, February 12, 2020 5:01:37 AM EST MAUPERTUIS, PHILIPPE wrote:
> Like many, we are using aide and clamav.
> I woud like to have an audit record when these program are run but no
> records for what they are doing. I mean, I want to know that clamscan or
> aide has been launched but not that it checks say /etc/passwd whatever
> rules could be in place for /etc/passwd

Then all you need to do is place a watch on them.

-a always,exit -F path=path-to-aide -F perm=x -F key=something-ran

-Steve