From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcelo Cerri Subject: Re: linux auditd: Not getting log for chmod syscall Date: Wed, 18 Jan 2012 10:10:39 -0200 Message-ID: <4F16B6BF.9000908@linux.vnet.ibm.com> References: <201201131504.38174.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx14.extmail.prod.ext.phx2.redhat.com [10.5.110.19]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id q0ICAkeq016359 for ; Wed, 18 Jan 2012 07:10:46 -0500 Received: from e24smtp04.br.ibm.com (e24smtp04.br.ibm.com [32.104.18.25]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q0ICAiXO016127 for ; Wed, 18 Jan 2012 07:10:45 -0500 Received: from /spool/local by e24smtp04.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 18 Jan 2012 10:10:43 -0200 Received: from d24av04.br.ibm.com (d24av04.br.ibm.com [9.8.31.97]) by d24relay01.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q0IC6wmw4726952 for ; Wed, 18 Jan 2012 09:06:58 -0300 Received: from d24av04.br.ibm.com (loopback [127.0.0.1]) by d24av04.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q0ICARtt014687 for ; Wed, 18 Jan 2012 10:10:27 -0200 Received: from oc8526070481.ibm.com (oc8526070481.ibm.com.br.ibm.com [9.7.38.155]) by d24av04.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVin) with ESMTP id q0ICARrl014674 for ; Wed, 18 Jan 2012 10:10:27 -0200 In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com Just remove the quotes. It's only necessary when running auditctl directly from bash. Regards, Marcelo On 01/18/2012 09:10 AM, bharat gupta wrote: > when i am using auid>=500 in quote like u have told -a always,exit -F > arch=b64 -S chmod -S fchmod -S fchmodat -F > 'auid>=500' -F auid!=4294967295 -k perm_mod > > it is giving error : > #service auditd restart > Stopping auditd: [ OK ] > Starting auditd: [ OK ] > -F unknown field: "auid > There was an error in line 102 of /etc/audit/audit.rules > > > > On Sat, Jan 14, 2012 at 1:34 AM, Steve Grubb > wrote: > > On Thursday, January 12, 2012 11:52:29 PM bharat gupta wrote: > > I am using redhat 6, and trying to create logs for some system > call using > > the rule given below: > > > > *-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F > auid>=500 > > -F auid!=4294967295 -k perm_mod* > > The rule works for me. > > # auditctl -a always,exit -F arch=b64 -S chmod -S fchmod -S > fchmodat -F > 'auid>=500' -F auid!=4294967295 -k perm_mod > > I don't have any asterisk and I have single quote marks since bash > will > interpret the > as a redirection. But then doing a chmod command, > it does pick > up the fchmodat() syscall. > > > > After running command chmod i was not able to get any log, but > when i used > > strace command i have seen that syscall have been called. > > I also checked that auditd service is running properly. > > When you use auditctl -l, is the rule just like you expected? > > LIST_RULES: exit,always arch=3221225534 (0xc000003e) auid>=500 > (0x1f4) auid!=-1 > (0xffffffff) key=perm_mod syscall=chmod,fchmod,fchmodat > > It should just work unless you are on a distribution that does not > really > support auditing. > > -Steve > > > > > -- > Bharat Gupta > IIT -Roorkee > > > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit