* Converting relative path to absolute path
@ 2013-12-06 3:35 Aaron Lewis
2013-12-06 16:42 ` Peter Moody
0 siblings, 1 reply; 3+ messages in thread
From: Aaron Lewis @ 2013-12-06 3:35 UTC (permalink / raw)
To: linux-audit
Hi,
If I access a file with relative path, the PATH audit message would be
a relative path as well.
I wonder if I can change this behavior without modifying the kernel?
(It seem audit daemon just receive the msg= field from kernel directly)
--
Best Regards,
Aaron Lewis - PGP: 0xDFE6C29E ( http://keyserver.veridis.com )
Finger Print: 9482 448F C7C3 896C 1DFE 7DD3 2492 A7D0 DFE6 C29E
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Converting relative path to absolute path
2013-12-06 3:35 Converting relative path to absolute path Aaron Lewis
@ 2013-12-06 16:42 ` Peter Moody
2013-12-06 17:33 ` Steve Grubb
0 siblings, 1 reply; 3+ messages in thread
From: Peter Moody @ 2013-12-06 16:42 UTC (permalink / raw)
To: Aaron Lewis; +Cc: linux-audit@redhat.com
On Thu, Dec 5, 2013 at 7:35 PM, Aaron Lewis <the.warl0ck.1989@gmail.com> wrote:
> Hi,
>
> If I access a file with relative path, the PATH audit message would be
> a relative path as well.
>
> I wonder if I can change this behavior without modifying the kernel?
IIUC, there should be a CWD message to go along with the PATH message.
You should be able to use that to find the absolute path
> (It seem audit daemon just receive the msg= field from kernel directly)
>
> --
> Best Regards,
> Aaron Lewis - PGP: 0xDFE6C29E ( http://keyserver.veridis.com )
> Finger Print: 9482 448F C7C3 896C 1DFE 7DD3 2492 A7D0 DFE6 C29E
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
--
[ Peter Moody | Security Engineer | Google ]
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Converting relative path to absolute path
2013-12-06 16:42 ` Peter Moody
@ 2013-12-06 17:33 ` Steve Grubb
0 siblings, 0 replies; 3+ messages in thread
From: Steve Grubb @ 2013-12-06 17:33 UTC (permalink / raw)
To: linux-audit
On Friday, December 06, 2013 08:42:44 AM Peter Moody wrote:
> > If I access a file with relative path, the PATH audit message would be
> > a relative path as well.
> >
> > I wonder if I can change this behavior without modifying the kernel?
>
> IIUC, there should be a CWD message to go along with the PATH message.
> You should be able to use that to find the absolute path
That is correct. What I do is take the cwd field and concatenate path and then
run it through realpath(3) to finalize it.
-Steve
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-12-06 17:33 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-12-06 3:35 Converting relative path to absolute path Aaron Lewis
2013-12-06 16:42 ` Peter Moody
2013-12-06 17:33 ` Steve Grubb
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).