How to tell what process accessed a file

2004-02-14 Thread Wade Richards
Hi, This isn't a major problem for me, but since it's related to auditing file access, I thought the security people would have an answer. Every once in a while I get a bunch of errors because some process tried to access my CDROM, triggering automount when there's no disk in the drive. I'd

Re: [ [Dri-devel] XFree86 local root exploit]

2004-02-14 Thread LeVA
2004. februr 12. 19:45 dtummal Ryan Underwood ezt rta: Thanks a lot! Daniel -- LeVA -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: How to tell what process accessed a file

2004-02-14 Thread Phillip Hofmeister
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, 14 Feb 2004 at 01:31:52PM -0500, Wade Richards wrote: Hi, This isn't a major problem for me, but since it's related to auditing file access, I thought the security people would have an answer. Every once in a while I get a bunch of

Re: How to tell what process accessed a file

2004-02-14 Thread hanasaki
what package and deamon does the audit of every file executed? Phillip Hofmeister wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, 14 Feb 2004 at 01:31:52PM -0500, Wade Richards wrote: Hi, This isn't a major problem for me, but since it's related to auditing file access, I thought

Re: How to tell what process accessed a file

2004-02-14 Thread Jan Minar
On Sat, Feb 14, 2004 at 01:50:06PM -0600, hanasaki wrote: what package and deamon does the audit of every file executed? RSBAC has such a facility. Executing is done by calling execve(2). The section number `2' informs us this is a system call. Therefore, such an accounting must be

Re: How to tell what process accessed a file

2004-02-14 Thread Marcin
Hello, what package and deamon does the audit of every file executed? if you patch the kernel with GRsecurity - you can turn on logging of executing, sended singals, failed forking, changing date/time, even changing the directory :) www.grsecurity.org all goes to syslog or you can start

Re: How to tell what process accessed a file

2004-02-14 Thread Phillip Hofmeister
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, 14 Feb 2004 at 02:50:06PM -0500, hanasaki wrote: what package and deamon does the audit of every file executed? As I said, it is the GRSecurity Kernel patch (http://www.hgrsecurity.org). When you apply the patch audits get sent to the

Re: How to tell what process accessed a file

2004-02-14 Thread Jean Christophe André
On Sat, Feb 14, 2004 at 01:50:06PM -0600, hanasaki wrote: what package and deamon does the audit of every file executed? Selon Jan Minar [EMAIL PROTECTED]: RSBAC has such a facility. Executing is done by calling execve(2). The section number `2' informs us this is a system call.

Re: How to tell what process accessed a file

2004-02-14 Thread Jan Minar
On Sun, Feb 15, 2004 at 04:25:48AM +0700, Jean Christophe André wrote: On Sat, Feb 14, 2004 at 01:50:06PM -0600, hanasaki wrote: what package and deamon does the audit of every file executed? Selon Jan Minar [EMAIL PROTECTED]: RSBAC has such a facility. Executing is done by calling

Re: How to tell what process accessed a file

2004-02-14 Thread Mike O'Connor
On Sat, 2004-02-14 at 14:50, hanasaki wrote: what package and deamon does the audit of every file executed? There is the snoopy package which logs all execve calls. Phillip Hofmeister wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, 14 Feb 2004 at 01:31:52PM -0500, Wade

Re: How to tell what process accessed a file

2004-02-14 Thread Russell Coker
On Sun, 15 Feb 2004 05:31, Wade Richards [EMAIL PROTECTED] wrote: Every once in a while I get a bunch of errors because some process tried to access my CDROM, triggering automount when there's no disk in the drive. SE Linux can audit all interesting actions, exec, read, write, create,

Re: How to tell what process accessed a file

2004-02-14 Thread hanasaki
How about the below? apt-cache show trustees It looks interstesting but I dont have much time to mess with it. Russell Coker wrote: On Sun, 15 Feb 2004 05:31, Wade Richards [EMAIL PROTECTED] wrote: Every once in a while I get a bunch of errors because some process tried to access my

How to tell what process accessed a file

2004-02-14 Thread Wade Richards
Hi, This isn't a major problem for me, but since it's related to auditing file access, I thought the security people would have an answer. Every once in a while I get a bunch of errors because some process tried to access my CDROM, triggering automount when there's no disk in the drive. I'd

Re: [ [Dri-devel] XFree86 local root exploit]

2004-02-14 Thread LeVA
2004. február 12. 19:45 dátummal Ryan Underwood ezt írta: Thanks a lot! Daniel -- LeVA

Re: How to tell what process accessed a file

2004-02-14 Thread Phillip Hofmeister
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, 14 Feb 2004 at 01:31:52PM -0500, Wade Richards wrote: Hi, This isn't a major problem for me, but since it's related to auditing file access, I thought the security people would have an answer. Every once in a while I get a bunch of

Re: How to tell what process accessed a file

2004-02-14 Thread hanasaki
what package and deamon does the audit of every file executed? Phillip Hofmeister wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, 14 Feb 2004 at 01:31:52PM -0500, Wade Richards wrote: Hi, This isn't a major problem for me, but since it's related to auditing file access, I

Re: How to tell what process accessed a file

2004-02-14 Thread Jan Minar
On Sat, Feb 14, 2004 at 01:50:06PM -0600, hanasaki wrote: what package and deamon does the audit of every file executed? RSBAC has such a facility. Executing is done by calling execve(2). The section number `2' informs us this is a system call. Therefore, such an accounting must be

Re: How to tell what process accessed a file

2004-02-14 Thread Marcin
Hello, what package and deamon does the audit of every file executed? if you patch the kernel with GRsecurity - you can turn on logging of executing, sended singals, failed forking, changing date/time, even changing the directory :) www.grsecurity.org all goes to syslog or you can start

Re: How to tell what process accessed a file

2004-02-14 Thread Phillip Hofmeister
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, 14 Feb 2004 at 02:50:06PM -0500, hanasaki wrote: what package and deamon does the audit of every file executed? As I said, it is the GRSecurity Kernel patch (http://www.hgrsecurity.org). When you apply the patch audits get sent to the

Re: How to tell what process accessed a file

2004-02-14 Thread Jean Christophe André
On Sat, Feb 14, 2004 at 01:50:06PM -0600, hanasaki wrote: what package and deamon does the audit of every file executed? Selon Jan Minar [EMAIL PROTECTED]: RSBAC has such a facility. Executing is done by calling execve(2). The section number `2' informs us this is a system call.

Re: How to tell what process accessed a file

2004-02-14 Thread Jan Minar
On Sun, Feb 15, 2004 at 04:25:48AM +0700, Jean Christophe André wrote: On Sat, Feb 14, 2004 at 01:50:06PM -0600, hanasaki wrote: what package and deamon does the audit of every file executed? Selon Jan Minar [EMAIL PROTECTED]: RSBAC has such a facility. Executing is done by calling

Re: How to tell what process accessed a file

2004-02-14 Thread Mike O'Connor
On Sat, 2004-02-14 at 14:50, hanasaki wrote: what package and deamon does the audit of every file executed? There is the snoopy package which logs all execve calls. Phillip Hofmeister wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, 14 Feb 2004 at 01:31:52PM -0500, Wade

Re: How to tell what process accessed a file

2004-02-14 Thread Russell Coker
On Sun, 15 Feb 2004 05:31, Wade Richards [EMAIL PROTECTED] wrote: Every once in a while I get a bunch of errors because some process tried to access my CDROM, triggering automount when there's no disk in the drive. SE Linux can audit all interesting actions, exec, read, write, create,