From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 21070C4743C for ; Mon, 21 Jun 2021 17:16:48 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id B697F6108E for ; Mon, 21 Jun 2021 17:16:47 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B697F6108E Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=tempfail smtp.mailfrom=linux-audit-bounces@redhat.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1624295806; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=RZ3osi2vqRzNswHdzsl+FPFqHvVu4Nq7yO6B89LvJ1A=; b=bM6nzLw3UIx3KJa1JJWPhYMz/zVSOvXnatoHUIKMq4BB1HQr7NfXLXQNXdaObKvI/aDMKr h2dAuBWKVQxqTpc4MXNdCNGrxhvMh3mt0H4/O8ioETaG/0JWntdSXRUq2iZ/vP3SoJOWLA N9Im09vYCXW9yewycTMFgN/kWhFN16A= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-49-m5m9qUU7Pg-MPM_9MFLjpg-1; Mon, 21 Jun 2021 13:16:45 -0400 X-MC-Unique: m5m9qUU7Pg-MPM_9MFLjpg-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 60B9B100C67F; Mon, 21 Jun 2021 17:16:41 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id CAC751009962; Mon, 21 Jun 2021 17:16:40 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 44CAE4A712; Mon, 21 Jun 2021 17:16:40 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 15LHGcY3006519 for ; Mon, 21 Jun 2021 13:16:38 -0400 Received: by smtp.corp.redhat.com (Postfix) id C5AE81AFF2; Mon, 21 Jun 2021 17:16:38 +0000 (UTC) Received: from x2.localnet (ovpn-112-68.rdu2.redhat.com [10.10.112.68]) by smtp.corp.redhat.com (Postfix) with ESMTP id 75AD71AFF0; Mon, 21 Jun 2021 17:16:34 +0000 (UTC) From: Steve Grubb To: linux-audit@redhat.com Subject: Re: Internal commands track in AuditD Date: Mon, 21 Jun 2021 13:16:34 -0400 Message-ID: <5725646.lOV4Wx5bFT@x2> Organization: Red Hat In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-loop: linux-audit@redhat.com X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=linux-audit-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit On Sunday, June 20, 2021 4:42:48 PM EDT Muthamilan Sargunaanandan wrote: > I would like to add the Internal commands (example cd , |, > and etc) track > in AuditD. Internal to what? Auditd just logs events to disk. The kernel is what decides what should be logged. The kernel's view is pretty much what you'd see in strace output. If there is something in the strace that is significant, a syscall rule can be written for it. > Can I get the auditd rules to trace the user commands including the > internal commands. The kernel doesn't have visibility into the meaning of anything users do. But what it can do is record any keystrokes that a user may type regardless of what program is receiving the characters. You can look into pam_tty_audit if you want to do that. It will record these as TTY events that you can later post process -Steve -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit