From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: Internal commands track in AuditD
Date: Mon, 21 Jun 2021 13:16:34 -0400 [thread overview]
Message-ID: <5725646.lOV4Wx5bFT@x2> (raw)
In-Reply-To: <CAFMjzz68krVGaUruAzZyGz2d-2f0iEhmTYi-D74=pOQaW2qbTA@mail.gmail.com>
On Sunday, June 20, 2021 4:42:48 PM EDT Muthamilan Sargunaanandan wrote:
> I would like to add the Internal commands (example cd , |, > and etc) track
> in AuditD.
Internal to what? Auditd just logs events to disk. The kernel is what decides
what should be logged. The kernel's view is pretty much what you'd see in
strace output. If there is something in the strace that is significant, a
syscall rule can be written for it.
> Can I get the auditd rules to trace the user commands including the
> internal commands.
The kernel doesn't have visibility into the meaning of anything users do. But
what it can do is record any keystrokes that a user may type regardless of
what program is receiving the characters. You can look into pam_tty_audit if
you want to do that. It will record these as TTY events that you can later
post process
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
prev parent reply other threads:[~2021-06-21 17:16 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-20 20:42 Internal commands track in AuditD Muthamilan Sargunaanandan
2021-06-21 13:26 ` Richard Guy Briggs
2021-06-21 17:16 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5725646.lOV4Wx5bFT@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox