On Friday, September 8, 2017 4:41:47 AM EDT Richard Guy Briggs wrote: > On 2017-09-07 18:32, Steve Grubb wrote: > > On Wednesday, September 6, 2017 6:03:18 AM EDT Lev Olshvang wrote: > > > I got only following SYSCALL record in audit log for 'touch -t ' > > > command, no CWD, no PATH record > > > > Out of curiosity, what kind of rule were you using? > > > > > type=SYSCALL msg=audit(1503837757.149:266995): > > > arch=c000003e syscall=280 success=yes exit=0 a0=0 a1=0 a2=7fffbb26bb10 > > > a3=0 items=0 ppid=101 pid=102 auid=1000 uid=0 gid=31 euid=0 suid=0 > > > fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts4 ses=1 comm="touch" > > > exe="/bin/touch" key="times" > > > > I think you found a problem. I also think the syscall should be added to: > > > > include/asm-generic/audit_change_attr.h > > Steve, my naive addition of utime, utimes, futimesat and utimensat to > include/asm-generic/audit_change_attr.h seems to have made no > difference.
There seems to be 2 problems. 1) the utimensat syscall not getting a path record, 2) you can't use the -F perms=a because the syscall tables seem to be way out of date. fchmodat seems to be the last syscall added. There's about 70 new syscalls that need to be looked through and added. This is the easier of the 2 problems. -Steve > > I think this syscall and others have been added since the watch > > permissions files were setup. > > > > -Steve > > - RGB > > -- > Richard Guy Briggs <[email protected]> > Sr. S/W Engineer, Kernel Security, Base Operating Systems > Remote, Ottawa, Red Hat Canada > IRC: rgb, SunRaycer > Voice: +1.647.777.2635, Internal: (81) 32635 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
