From mboxrd@z Thu Jan 1 00:00:00 1970 From: Florian Crouzat Subject: Re: auditd on nonexistent files Date: Wed, 16 Sep 2015 09:56:58 +0200 Message-ID: <55F920CA.8020703@floriancrouzat.net> References: <55F6EF4D.7050203@sensa.is> <20150915101503.0dd9e4d4@ivy-bridge> <20150915100734.GY8140@madcap2.tricolour.ca> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mx1.redhat.com (ext-mx06.extmail.prod.ext.phx2.redhat.com [10.5.110.30]) by int-mx14.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t8G7vEng012950 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Wed, 16 Sep 2015 03:57:14 -0400 Received: from slow1-d.mail.gandi.net (slow1-d.mail.gandi.net [217.70.178.86]) by mx1.redhat.com (Postfix) with ESMTP id 286348C1BA for ; Wed, 16 Sep 2015 07:57:13 +0000 (UTC) Received: from relay3-d.mail.gandi.net (relay3-d.mail.gandi.net [217.70.183.195]) by slow1-d.mail.gandi.net (Postfix) with ESMTP id E05EF47BAD9 for ; Wed, 16 Sep 2015 09:57:11 +0200 (CEST) Received: from mfilter27-d.gandi.net (mfilter27-d.gandi.net [217.70.178.155]) by relay3-d.mail.gandi.net (Postfix) with ESMTP id 1E669A80AC for ; Wed, 16 Sep 2015 09:57:01 +0200 (CEST) Received: from relay3-d.mail.gandi.net ([IPv6:::ffff:217.70.183.195]) by mfilter27-d.gandi.net (mfilter27-d.gandi.net [::ffff:10.0.15.180]) (amavisd-new, port 10024) with ESMTP id 30X4Gm-6X-Xf for ; Wed, 16 Sep 2015 09:56:59 +0200 (CEST) Received: from marvin.lbg.office.lyra (unknown [37.1.253.83]) (Authenticated sender: tech@floriancrouzat.net) by relay3-d.mail.gandi.net (Postfix) with ESMTPSA id 90E1BA80B0 for ; Wed, 16 Sep 2015 09:56:59 +0200 (CEST) In-Reply-To: <20150915100734.GY8140@madcap2.tricolour.ca> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com T24gMDkvMTUvMjAxNSAxMjowNyBQTSwgUmljaGFyZCBHdXkgQnJpZ2dzIHdyb3RlOgo+IE9uIDE1 LzA5LzE1LCBTdGV2ZSBHcnViYiB3cm90ZToKPj4gT24gTW9uLCAxNCBTZXAgMjAxNSAxNjowMTox NyArMDAwMAo+PiBEYXbDrcOwIFN0ZWlubiBHZWlyc3NvbiA8ZHNnQHNlbnNhLmlzPiB3cm90ZToK Pj4KPj4+IEhpIGFsbCwKPj4+Cj4+PiBXaGF0IGlzIHRoZSBiZXN0IHByYWN0aWNlIGZvciB1c2lu ZyBhdWRpdGQgZm9yIGZpbGUgaW50ZWdyaXR5Cj4+PiBtb25pdG9yaW5nPwo+Pj4KPj4+IEZyb20g dGhlIGRvY3VtZW50YXRpb24sIEkgaGF2ZSB0aGlzLCB3aGljaCB3b3JrcyBmaW5lOgo+Pj4gLWEg YWx3YXlzLGV4aXQgLUYgZGlyPS9iaW4gLUYgcGVybT13YQo+Pj4KPj4+IEhvd2V2ZXIsIGl0IHNl ZW1zIHRoYXQgaWYgSSBoYXZlIGEgcnVsZSBvbiBhIG5vbmV4aXN0ZW50IGRpcmVjdG9yeSwKPj4+ IGF1ZGl0ZCB3aWxsIGZhaWwgdG8gYWRkIHRoZSBydWxlIChJIGFzc3VtZSBiZWNhdXNlIGl0J3Mg YWRkaW5nIGEgd2F0Y2gKPj4+IG9uIGFuIGlub2RlIG9yIHNvbWV0aGluZyBsaWtlIHRoYXQ/KSwg YnV0IGl0IHdpbGwgYWxzbyBqdXN0IHN0b3AKPj4+IHJlYWRpbmcgYXVkaXQucnVsZXMgYW5kIG5v dCBhZGQgYW55IHN1YnNlcXVlbnQgcnVsZXMuCj4+Pgo+Pj4gVGhpcyBpcyBiYWQgaW4gYW4gZW52 aXJvbm1lbnQgd2hlcmUgd2UgaGF2ZSB0byBoYXZlIEZJTSBmb3IgY3JpdGljYWwKPj4+IGFwcGxp Y2F0aW9uIGZpbGVzLCBidXQgd2hlcmUgYW5vdGhlciB0ZWFtIG1heSBiZSBtYWludGFpbmluZyBz b21lIG9mCj4+PiB0aGUgYXBwcyBhbmQgdGhlcmVmb3JlIG1pZ2h0IHJlbW92ZSBzb21lIHdhdGNo ZWQgZGlyZWN0b3JpZXMsCj4+PiBlc3BlY2lhbGx5IGFzIHRoZWlyIG1pc2hhcHMgbWF5IGltcGFj dCBhdWRpdGluZyBmb3Igb3RoZXIgcGFydHMgb2YKPj4+IHRoZSBzeXN0ZW0uCj4+Pgo+Pj4gQ2Fu IHNvbWV0aGluZyBiZSBkb25lIHRvIGdldCBiZXR0ZXIgYmVoYXZpb3VyIGhlcmU/Cj4+Pgo+Pj4g SSBzZWUgdHdvIHdheXMgaXQgY291bGQgYmUgYmV0dGVyCj4+PiAxKSAodGhlIGlkZWFsIGNhc2Up IGF1ZGl0ZCB3aWxsIGFkZCBydWxlcyBldmVuIGZvciBub25leGlzdGVudAo+Pj4gZGlyZWN0b3Jp ZXMsIGFuZCB3aGVuIHRoZXkgYXJlIGNyZWF0ZWQgd2lsbCBhZGQgYSB3YXRjaCBmb3IgdGhlbS4g SWYgYQo+Pj4gZGlyZWN0b3J5IGlzIHJlbW92ZWQgYW5kIGFub3RoZXIgY3JlYXRlZCB3aXRoIHRo ZSBzYW1lIG5hbWUsIGF1ZGl0ZAo+Pj4gd2lsbCBhZGQgYSB3YXRjaCBvbiB0aGUgbmV3IGRpcmVj dG9yeS4KPj4KPj4gV2hpY2gga2VybmVsIGFyZSB5b3UgdXNpbmc/IEkgd2FudCB0byB0aGluayB0 aGlzIHdhcyBmaXhlZCBpbiBrZXJuZWxzCj4+IGFyb3VuZCAyLjYuMzYgb3IgbGF0ZXIuIFRoaXMg b3JpZ2luYWwgcHJvYmxlbSB3YXMgdGhhdCB0aGUgYXVkaXQKPj4gd2F0Y2hlcyBhcmUgYmFzZWQg b24gaW5vdGlmeSB3aGljaCBuZWVkcyBhbiBpbm9kZS4gSWYgdGhlcmUncyBubyBpbm9kZSwKPj4g eW91IGNhbid0IHBsYWNlIHRoZSB3YXRjaC4KPiAKPiBBIHdhdGNoIGNhbiBiZSBhZGRlZCBmb3Ig YSBmaWxlIHRoYXQgZG9lcyBub3QgZXhpc3Qgd2hpbGUgdGhlIGNvbnRhaW5pbmcKPiBkaXJlY3Rv cnkgZG9lcywgYnV0IGEgZGlyZWN0b3J5IHRoYXQgZG9lcyBub3QgZXhpc3QgKHdoZW4gdGhlIGNv bnRhaW5pbmcKPiBkaXJlY3RvcnkgZG9lcyBub3QgZXhpc3QpIGRvZXMgbm90IHdvcmsuCj4gCj4+ PiAyKSBhdWRpdGQgc3RpbGwgY2Fubm90IGFkZCB3YXRjaGVzIHRvIG5vbmV4aXN0ZW50IGRpcmVj dG9yaWVzLCBidXQgYQo+Pj4gZmFpbGVkIHJ1bGUgYWRkIGZyb20gYXVkaXQucnVsZXMgd2lsbCBi ZWNvbWUgYSB3YXJuaW5nIHJhdGhlciB0aGFuIGFuCj4+PiBlcnJvciBzbyBzdWJzZXF1ZW50IHdh dGNoZXMgc3RpbGwgZ2V0IGFkZGVkLgo+Pgo+PiBDaGVjayBpbnRvIGFkZGluZyAtaSBvciAtYyBu ZWFyIHRoZSB0b3Agb2YgeW91ciBydWxlcy4KPj4KPj4gLVN0ZXZlCj4+Cj4+PiBJIHN1c3BlY3Qg MSkgaXMgbm90IHBvc3NpYmxlLCBidXQgY2FuIEkgZ2V0IGF1ZGl0ZCB0byBiZWhhdmUgbGlrZSBp bgo+Pj4gMik/Cj4gCj4gMSkgaXMgbm90IGN1cnJlbnRseSBpbXBsZW1lbnRlZCwgYnV0IGlzIHdv cnRoIGRpc2N1c3NpbmcuCj4gCj4+PiBEYXbDrcOwCgpJIGFza2VkIHRoZSBzYW1lIHF1ZXN0aW9u IGluIHRoZSAiV2F0Y2hpbmcgb3ZlciBub24tZXhpc3RlbnQgZm9sZGVyIHRvCm1haW50YWluIGEg Z2VuZXJpYyBhdWRpdC5ydWxlcyBmaWxlIiB0aHJlYWQgYnV0IGdvdCBkaWZmZXJlbnQgaGludHMu CkkndmUgYmVlbiBkaXJlY3RlZCB0byBhdWdlbnJ1bGVzIHdoaWNoIGNvdWxkIGhlbHAgYnV0IHRo aXMgZG9lc24ndApyZWFsbHkgbWF0Y2ggb3IgZmFjaWxpdGF0ZSBteSBuZWVkcyB0byByZXBsYWNl IG15IGN1cnJlbnQgRklNIHRvb2wgYnkKYXVkaXRkIHdoaWNoIHJlcXVpcmVzIG1lIHRvIHdyaXRl IGEgZ2VuZXJpYyBjb25maWd1cmF0aW9uIHdpdGggYWxsCnBvc3NpYmxlcyBmb2xkZXJzIChpbmNs dWRpbmcgYXBwbGljYXRpdmUgb25lcykgYW5kIGRlcGxveSBhY2Nyb3NzIGFsbApob3N0cyB3aXRo b3V0IGtub3dpbmcgd2hpY2ggaG9zdCBydW5zIHdoaWNoIGFwcCBhbmQvb3IgY29udGFpbnMgd2hp Y2gKZm9sZGVycy4KCkkgZ3Vlc3MgSSdsbCBzdGljayBieSB0aGlzIHRocmVhZCBub3cuCkhhdmUg eW91IHRyaWVkIHRoZSAtaSBvciAtYyBoaW50ID8KCkZsb3JpYW4KCgotLQpMaW51eC1hdWRpdCBt YWlsaW5nIGxpc3QKTGludXgtYXVkaXRAcmVkaGF0LmNvbQpodHRwczovL3d3dy5yZWRoYXQuY29t L21haWxtYW4vbGlzdGluZm8vbGludXgtYXVkaXQ=