Audit rules use of flags.
Hello all:
I have a requirement to audit/log all failed attempts to access files. I entered the following line in audit.rules:
-w exit,always -S open -F success!=0
and audit flags all file exits regardless of success. When I try:
-w exit,possible -S open -F success!=0
it does NOT flag any file openings, including failure. I am curious if:
-w exit,never -S open -F success=0
but I suspect that the 'first hit takes it' nature of audit-1.0.12 will make the flag at the end useless.
So I suppose the question is - do I need to put the -F flag before the -w portion of the entry, or is there some other way to meet the requirement?
Thank you all for any insight.
Quoted 6 lines · On Wednesday 21 February 2007 21:48:33 Walt Powell wrote:
I have a requirement to audit/log all failed attempts to access files. I entered the following line in audit.rules:
-w exit,always -S open -F success!=0
and audit flags all file exits regardless of success.
Which kernel are you using? Answering all your questions depends on that.
-Steve
Quoted 1 line · Walt Powell
I have a requirement to audit/log all failed attempts to access files.
If you are on x86_64, I think you'll need a new kernel. There was a problem in exit codes and sign extention during promotion.
Quoted 5 lines
I entered the following line in audit.rules:
-w exit,always -S open -F success!=0
and audit flags all file exits regardless of success.
See below. I think you can get this with 2 rules until you can update your kernel.
Quoted 5 lines
When I try:
-w exit,possible -S open -F success!=0
it does NOT flag any file openings, including failure.
Possible only collects information so that if another rule actually triggers an event, it has everything on hand to give a full context dump. Generally, you do not need "possible" rules.
Quoted 6 lines
I am curious if:
-w exit,never -S open -F success=0
but I suspect that the 'first hit takes it' nature of audit-1.0.12 will make the flag at the end useless.
Yes, but you should be able to follow that rule with:
-w exit,always -S open
which means the success !=0 case hits the second rule.
Quoted 2 lines
So I suppose the question is - do I need to put the -F flag before the -w portion of the entry, or is there some other way to meet the requirement?
No, you have to use syscall auditing for this and not watches.
-Steve