Bypassing audit's file watches

[Steve]

I have found that I can modify files that are being watched and audit 
not catch it (ie. no events are dispatched).  When monitoring a file for 
all system calls, I can:

echo "" > /file/to/watch
or

cat some_file > /file/to/watch

without generating audit events.  I assume this has to do with how the 
kernel handles re-direction.  Is it possible to catch these modifications?

Thanks,
Steve

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit