Alexander Viro wrote: > On Tue, Jun 27, 2006 at 05:36:43PM -0400, Linda Knippers wrote: > >>Steve Grubb wrote: >> >>>On Tuesday 27 June 2006 17:15, Amy Griffis wrote: >>> >>> >>>>If you would like to see a record in this case, you must add a watch >>>>for /var/log/audit. >>> >>> >>>I don't see a record watching this either. >> >>I think we're missing the directory lookup syscall(s) on watches >>right now. > > > Careful - that's one hell of a hot path. Note that we'll get many of > those for each syscall that does pathname resolution; moreover, when > we hit dcache, we should be careful about blocking.
Maybe its not actually the lookup we need. If I do this on RHEL4 I get an audit record for an open failure on /var/log/audit. With the .34 lspp kernel and the 1.2.2 audit tools, I don't get a record for a failed open, even though open seems to be registered with the watch. > [EMAIL PROTECTED] kernel]# /sbin/auditctl -l > LIST_RULES: exit,always watch=/var/log/audit/audit.log (0x18) > syscall=open,truncate,ftruncate,rename,mkdir,rmdir,creat,link,unlink,symlink,chmod,fchmod,chown,fchown,lchown > LIST_RULES: exit,always watch=/var/log/audit (0xe) > syscall=open,truncate,ftruncate,rename,mkdir,rmdir,creat,link,unlink,symlink,chmod,fchmod,chown,fchown,lchown -- ljk -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
