auditd on nonexistent files

["Davíð Steinn Geirsson" <dsg@sensa.is>]

[-- Attachment #1.1: Type: text/plain, Size: 1364 bytes --]

Hi all,

What is the best practice for using auditd for file integrity monitoring?

From the documentation, I have this, which works fine:
-a always,exit -F dir=/bin -F perm=wa

However, it seems that if I have a rule on a nonexistent directory,
auditd will fail to add the rule (I assume because it's adding a watch
on an inode or something like that?), but it will also just stop reading
audit.rules and not add any subsequent rules.

This is bad in an environment where we have to have FIM for critical
application files, but where another team may be maintaining some of the
apps and therefore might remove some watched directories, especially as
their mishaps may impact auditing for other parts of the system.


Can something be done to get better behaviour here?

I see two ways it could be better
1) (the ideal case) auditd will add rules even for nonexistent
directories, and when they are created will add a watch for them. If a
directory is removed and another created with the same name, auditd will
add a watch on the new directory.

2) auditd still cannot add watches to nonexistent directories, but a
failed rule add from audit.rules will become a warning rather than an
error so subsequent watches still get added.

I suspect 1) is not possible, but can I get auditd to behave like in 2)?

Best regards,
Davíð


[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]