From mboxrd@z Thu Jan 1 00:00:00 1970 From: Linda Knippers Subject: Re: capture mount event in /var/log/audit/audit.log Date: Sat, 07 Jul 2012 18:18:23 -0400 Message-ID: <4FF8B5AF.9080007@hp.com> References: Reply-To: linda.knippers@hp.com Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx11.extmail.prod.ext.phx2.redhat.com [10.5.110.16]) by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id q67MJ81j003683 for ; Sat, 7 Jul 2012 18:19:08 -0400 Received: from g1t0028.austin.hp.com (g1t0028.austin.hp.com [15.216.28.35]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q67MJ7H6005688 for ; Sat, 7 Jul 2012 18:19:07 -0400 In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Betty Man Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com Betty Man wrote: > Hi Everyone, > > in RHEL 5.5 kernel 2.6.18-194.el5 audit-1.7.17-3.el5 > > Have the following in the /etc/audit/audit.rules > ## non-privilege users using mount command. > -a exit,always -F arch=b32 -S mount -F auid>=500 -F auid!=4294967295 -k export > -a exit,always -F arch=b64 -S mount -F auid>=500 -F auid!=4294967295 -k export This audits the mount system call, rather than the mount command. > > from a general user account > > $ mount /dev/hdc /dev/cdrom > mount: only root can do that > > but /var/log/audit/audit.log does not capture this event > > Any input is much appreciated! My guess is that the mount command is doing its own check and is failing before it attempts the mount system call. If you run $ strace mount /dev/hdc /dev/cdrom you'll see the system calls that are executed. I suspect there is no mount system call in the output. -- ljk > > Thanks in advance > > Betty > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit