11:27 a.m.
Per the man page, to remove a watch, do the following:
-W path
Remove a watch for the file system object at path.
However, I get the following:
# auditctl -l
LIST_RULES: exit,always watch=/etc/hosts perm=rwa key=hosts-file
LIST_RULES: exit,always watch=/etc/resolv.conf perm=wa key=resolv
# auditctl -W /etc/hosts
Error sending delete rule data request (No such file or directory)
What am I doing wrong?
3:20 p.m.
On Monday, November 08, 2010 12:27:47 pm Michael Convey wrote:
# auditctl -l
LIST_RULES: exit,always watch=/etc/hosts perm=rwa key=hosts-file
LIST_RULES: exit,always watch=/etc/resolv.conf perm=wa key=resolv
# auditctl -W /etc/hosts
Error sending delete rule data request (No such file or directory)
What am I doing wrong?
You have to match each field in the rule:
[root ~]# auditctl -w /etc/hosts -p wa -k hosts-file
[root ~]# auditctl -l
LIST_RULES: exit,always watch=/etc/hosts perm=wa key=hosts-file
[root ~]# auditctl -W /etc/hosts -p wa -k hosts-file
[root ~]# auditctl -l
No rules
-Steve
3:50 p.m.
On Mon, Nov 8, 2010 at 1:20 PM, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Monday, November 08, 2010 12:27:47 pm Michael Convey wrote:
> # auditctl -l
> LIST_RULES: exit,always watch=/etc/hosts perm=rwa key=hosts-file
> LIST_RULES: exit,always watch=/etc/resolv.conf perm=wa key=resolv
> # auditctl -W /etc/hosts
> Error sending delete rule data request (No such file or directory)
>
> What am I doing wrong?
You have to match each field in the rule:
[root ~]# auditctl -w /etc/hosts -p wa -k hosts-file
[root ~]# auditctl -l
LIST_RULES: exit,always watch=/etc/hosts perm=wa key=hosts-file
[root ~]# auditctl -W /etc/hosts -p wa -k hosts-file
[root ~]# auditctl -l
No rules
-Steve
Worked perfectly, thanks!!
Perhaps someone could update the man page to make this more clear. The man
page indicates "-W" and "path" are the only arguments needed.
Mike
7:39 p.m.
This might be a dumb question but why not just manually edit the audit.rules
file using 'vi' or some other text editor instead of using auditctl?
-M.
On Mon, Nov 8, 2010 at 4:20 PM, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Monday, November 08, 2010 12:27:47 pm Michael Convey wrote:
> # auditctl -l
> LIST_RULES: exit,always watch=/etc/hosts perm=rwa key=hosts-file
> LIST_RULES: exit,always watch=/etc/resolv.conf perm=wa key=resolv
> # auditctl -W /etc/hosts
> Error sending delete rule data request (No such file or directory)
>
> What am I doing wrong?
You have to match each field in the rule:
[root ~]# auditctl -w /etc/hosts -p wa -k hosts-file
[root ~]# auditctl -l
LIST_RULES: exit,always watch=/etc/hosts perm=wa key=hosts-file
[root ~]# auditctl -W /etc/hosts -p wa -k hosts-file
[root ~]# auditctl -l
No rules
-Steve
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
8:27 p.m.
On Monday, November 08, 2010 08:39:30 pm Mike Nixon wrote:
This might be a dumb question but why not just manually edit the
audit.rules file using 'vi' or some other text editor instead of using
auditctl?
For permanent changes, I think that is what you want to do. But there may be times
when you are short on disk space and want to pull one, or maybe you were experimenting
and now you want to remove what you put in. :)
But this reminds me that we should have some capability to compare the rules file with
what's in the kernel.
-Steve
5071
days inactive
5072
days old
linux-audit@lists.linux-audit.osci.io
4 comments
3 participants
participants (3)
-
Michael Convey -
Mike Nixon -
Steve Grubb