Re: file watch: separating file reads and writes

[Steve Grubb <sgrubb@redhat.com>]

On Wednesday, July 09, 2014 04:00:18 AM Jon Smith wrote:
> I recently used auditd to setup a watch on a specific file (-w
> /path/to/my/file -p warx), but found it difficult to distinguish system
> calls that were modifying the file vs. reading from the file when using
> ausearch/aureport.
> 
> In response to that, I separated out the watches by keys:
> 
> -w /patch/to/my/file -p wa thisisawrite
> -w /path/to/my/file -p r thisisaread

This sounds like the correct way to do it.

 
> And then ran both aureport -k and aureport -f to join the keys to the system
> calls by event number.

Why not use ausearch -k? You can also give a partial key name since partial 
matching is the default. You could use: ausearch --start today -k thisisa


> Am I wholly approaching this the wrong way, or is there an easier way to
> distinguish between a syscall that reads from a file vs. writes to a file?

Well, what you are getting is the requested permissions, rather than actual 
use of the permissions. I think it can be assumed that if an app opens a file 
for write, it will eventually get around to that. But not always.

> Assuming this is the correct approach, would there then be a benefit to
> adding the key to the aureport -f output? I find it awkward to have to
> combine the two commands to get the necessary information.

No one has asked for that so far. There is one quirk about keys, you can have 
multiple keys for the same event. So, that could be a bit of text if you have 
several. The idea of aureport was to have a utility that can extract, total, 
and sort properties of the event.

-Steve