From mboxrd@z Thu Jan 1 00:00:00 1970 From: ramsdell@mitre.org (John D. Ramsdell) Subject: Re: open record looks like openat Date: 27 Jul 2007 14:14:06 -0400 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from mx2.redhat.com (mx2.redhat.com [10.255.15.25]) by int-mx2.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l6RIE9ON029459 for ; Fri, 27 Jul 2007 14:14:09 -0400 Received: from smtp-bedford.mitre.org (smtpproxy1.mitre.org [192.160.51.76]) by mx2.redhat.com (8.13.1/8.13.1) with ESMTP id l6RIE8Fp002434 for ; Fri, 27 Jul 2007 14:14:08 -0400 Received: from smtp-bedford.mitre.org (localhost.localdomain [127.0.0.1]) by smtp-bedford.mitre.org (8.12.11.20060308/8.12.11) with SMTP id l6RIE7GZ012472 for ; Fri, 27 Jul 2007 14:14:07 -0400 Received: from smtp-bedford.mitre.org (localhost.localdomain [127.0.0.1]) by smtp-bedford.mitre.org (Postfix) with ESMTP id 6ED48BEFB for ; Fri, 27 Jul 2007 14:14:07 -0400 (EDT) Received: from linus.mitre.org (rcf-smtp.mitre.org [129.83.10.1]) by smtp-bedford.mitre.org (8.12.11.20060308/8.12.11) with ESMTP id l6RIE7DQ012462 for ; Fri, 27 Jul 2007 14:14:07 -0400 Received: from oolong.mitre.org (oolong.mitre.org [129.83.162.84]) by linus.mitre.org (8.12.11/8.12.10) with ESMTP id l6RIE75l003011 for ; Fri, 27 Jul 2007 14:14:07 -0400 (EDT) In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Linux Audit List-Id: linux-audit@redhat.com ramsdell@mitre.org (John D. Ramsdell) writes: > I carefully studied the output of my analysis program, and found one > particularly odd line of output. I traced it back to an interesting > audit event in the raw log (syscall 5 is the open system call): I found the place in the source for the program that generates this system call. It is a call to freopen on stderr. John