From mboxrd@z Thu Jan 1 00:00:00 1970 From: Valdis.Kletnieks@vt.edu Subject: Re: Filesystem filling up ... Date: Fri, 29 Jun 2007 11:39:29 -0400 Message-ID: <8178.1183131569@turing-police.cc.vt.edu> References: <39d2723b0706271042y2885144dj29e7da8adc90e630@mail.gmail.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1989728618==" Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l5TFdVUx009889 for ; Fri, 29 Jun 2007 11:39:31 -0400 Received: from turing-police.cc.vt.edu (turing-police.cc.vt.edu [128.173.14.107]) by mx1.redhat.com (8.13.1/8.13.1) with ESMTP id l5TFdUVa015521 for ; Fri, 29 Jun 2007 11:39:30 -0400 In-Reply-To: Your message of "Wed, 27 Jun 2007 19:42:39 +0200." <39d2723b0706271042y2885144dj29e7da8adc90e630@mail.gmail.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Aaron Lippold Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============1989728618== Content-Type: multipart/signed; boundary="==_Exmh_1183131569_3843P"; micalg=pgp-sha1; protocol="application/pgp-signature" Content-Transfer-Encoding: 7bit --==_Exmh_1183131569_3843P Content-Type: text/plain; charset=us-ascii On Wed, 27 Jun 2007 19:42:39 +0200, Aaron Lippold said: > # Audit Failed opens > -a exit,always -S open -F success!=0 Note that a *lot* of programs will attempt to open optional config files, and happily go on their merry way when they get an -ENOENT leaving an audit entry for you to drown in. I just tested the venerable 'xfontsel', and at one point, it generated *12* -ENOENT in a row looking for a bitmap for a cursor before finding one it liked. The next 3 cursors only needed 9, 10, and 8 failed attempts before it found one. > # Audit success and failure of delete > -a exit,always -S unlink -S rmdir That's going to be really painful on any system that does software development, as your average compile generates a lot of temporary files that get unlinked. You may want to investigate whether it's feasible to ignore unlinks in /tmp. --==_Exmh_1183131569_3843P Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Exmh version 2.5 07/13/2001 iD8DBQFGhSexcC3lWbTT17ARAq9TAJ9nIK4jLTuNt3tLJNS7xhDKmUlJbACeK2Rb bUa2x9V84jDdEgo3Pnlc0Fc= =R1Gn -----END PGP SIGNATURE----- --==_Exmh_1183131569_3843P-- --===============1989728618== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1989728618==--