On Friday, October 09, 2015 02:43:59 PM Boyd Memmott wrote: > I have an audit question concerning echo "ThisIsATest" >>/tmp/test/file11 > > I have a rule: -w /tmp/test -p war -S all -k thekey > > It produces the following audit record. > type=SYSCALL msg=audit(1444398577.247:1581): arch=c000003e syscall=2 > success=yes exit=3 a0=1f5bca0 a1=441 a2=1b6 a3=20 items=2 ppid=17766 > pid=17808 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 > tty=pts3 ses=1 comm="bash" exe="/bin/bash" key="thekey" type=CWD > msg=audit(1444398577.247:1581): cwd="/tmp/test" > type=PATH msg=audit(1444398577.247:1581): item=0 name="/tmp/test" inode=1436 > dev=00:2e mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT type=PATH > msg=audit(1444398577.247:1581): item=1 name="file11" inode=6797 dev=00:2e > mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=CREATE > > I understand bash is the executable, because ">" is writing to the file via > a file handle. > > Is there another switch or rule that would improve the audit record to > capture echo as being the initiator of the command??
In this particular example, keystroke logging would. But in general, the answer is no. The reason being that echo is built-in to the shell while /bin/echo is an actual program. For reference, this is what happens when you type a command: * Bash checks if internal command and handles it * If its a subshell, – forks and starts reading lines and performing them * Else it: forks, sets up pipes, calls execve(filename, argv, envp) * Kernel has a list of supported formats –ia_32aout -Flat -Aout -Script -Em86 -Elf -elf_fdpic * It iterates through each handler until one accepts the file * Otherwise bash reports not an executable -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
