Re: execve

Hello,

ran another test on .56 kernel. I wanted to make sure we are logging parameters for execve so we can see what is being executed:

type=PATH msg=audit(06/07/05 14:14:28.592:5004271) : item=1 inode=770531 dev=03:02 mode=file,755 ouid=root ogid=root rdev=00:00 type=PATH msg=audit(06/07/05 14:14:28.592:5004271) : item=0 name=/bin/ls inode=1048599 dev=03:02 mode=file,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(06/07/05 14:14:28.592:5004271) : cwd=/root type=SYSCALL msg=audit(06/07/05 14:14:28.592:5004271) : arch=i386 syscall=execve success=yes exit=0 a0=9195ab8 a1=91a9838 a2=91b1900

items=2 pid=4167 auid=sgrubb uid=root gid=root euid=root suid=root

egid=root sgid=root fsgid=root comm=ls exe=/bin/ls

What is the first PATH record showing? I was expecting only 1 item, not

There is no name, yet the mode says its a file. I've checked several apps doing execve, they all have the same first record with same inode no

what I run.

-Steve

-- Linux-audit mailing list Linux-audit(a)redhat.com http://www.redhat.com/mailman/listinfo/linux-audit