From mboxrd@z Thu Jan  1 00:00:00 1970
From: Warron French <warron.french@gmail.com>
Subject: audit rules watching paths
Date: Sat, 11 Mar 2017 23:48:53 -0500
Message-ID: <52efd6db-ce51-0cb2-124c-b88241ffa09e@gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (ext-mx07.extmail.prod.ext.phx2.redhat.com
	[10.5.110.31])
	by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP
	id v2C4n3F3007636
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256
	verify=NO)
	for <linux-audit@redhat.com>; Sat, 11 Mar 2017 23:49:03 -0500
Received: from mail-qk0-f181.google.com (mail-qk0-f181.google.com
	[209.85.220.181])
	(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
	(No client certificate requested)
	by mx1.redhat.com (Postfix) with ESMTPS id 91F2FC04BD26
	for <linux-audit@redhat.com>; Sun, 12 Mar 2017 04:49:02 +0000 (UTC)
Received: by mail-qk0-f181.google.com with SMTP id y76so203805624qkb.0
	for <linux-audit@redhat.com>; Sat, 11 Mar 2017 20:49:01 -0800 (PST)
Received: from [192.168.1.202] (pool-108-28-75-176.washdc.fios.verizon.net.
	[108.28.75.176]) by smtp.googlemail.com with ESMTPSA id
	j20sm9635773qke.14.2017.03.11.20.49.00 for <linux-audit@redhat.com>
	(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
	Sat, 11 Mar 2017 20:49:00 -0800 (PST)
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

I know that I can add to the audit.rules file a rule like

-w /etc/ -p rawx -k watch_Etc

But how far down will this sort of audit rule monitor /etc/?  How many 
levels deep?


Thanks.