On Thursday 26 May 2005 14:39, Steve Grubb wrote: > Hello, > > I got a capture of audit doing a log rotate using: > > auditctl -w /var/log -k dir -p rwea > > type=SYSCALL msg=audit(05/26/05 15:24:55.023:13588534) : arch=i386 > syscall=rename success=yes exit=0 a0=94bc008 a1=94bc028 a2=8051254 a3=8054e00 > items=2 pid=1716 auid=unknown(4294967295) uid=root gid=root euid=root > suid=root fsuid=root egid=root sgid=root fsgid=root comm=auditd > exe=/sbin/auditd > type=FS_WATCH msg=audit(05/26/05 15:24:55.023:13588534) : watch=log > filterkey=dir perm=read,write,exec,append perm_mask=exec inode=29249 > inode_uid=root inode_gid=root inode_dev=03:07 inode_rdev=00:00 > type=FS_WATCH msg=audit(05/26/05 15:24:55.023:13588534) : watch=log > filterkey=dir perm=read,write,exec,append perm_mask=exec inode=29249 > inode_uid=root inode_gid=root inode_dev=03:07 inode_rdev=00:00 > type=PATH msg=audit(05/26/05 15:24:55.023:13588534) : item=0 > name=/var/log/audit/audit.log inode=29307 dev=03:07 mode=dir,750 ouid=root > ogid=root rdev=00:00 > type=PATH msg=audit(05/26/05 15:24:55.023:13588534) : item=1 > name=/var/log/audit/audit.log.1 inode=29307 dev=03:07 mode=dir,750 ouid=root > ogid=root rdev=00:00 > > The thing I'm wondering about is the mode not matching the object in PATH. The > watch is on a dir, but the item listed is not a dir, its a file with access > perms of 0640. Is the inode being reported the inode of audit/ or audit.log?

static inline int do_rename(const char * oldname, const char * newname) { int error = 0; struct dentry * old_dir, * new_dir; struct dentry * old_dentry, *new_dentry; struct dentry * trap; struct nameidata oldnd, newnd; error = path_lookup(oldname, LOOKUP_PARENT, &oldnd); if (error) goto exit; error = path_lookup(newname, LOOKUP_PARENT, &newnd); if (error) goto exit1;

On Thursday 26 May 2005 15:46, Timothy R. Chavez wrote: > Is the inode being reported the inode of audit/ or audit.log? logs have long since been rotated. I'll try to recreate in better way. Also, I've been torturing my machine with rule & watch insertion for over an hour. It seems to be doing fine. Maybe the undersized allocation was causing all my problems.

-Steve -- Linux-audit mailing list Linux-audit(a)redhat.com http://www.redhat.com/mailman/listinfo/linux-audit

Are you using a .49 or .50 kernel? I wasn't quite sure if David said "OK" to just using the hash table from now on or to use the i_audit field until we're in the clear.

David has incorporated most of the cleanups I had and then he made some more which I've also added to my tree.. and the last major thing I can think of is to correctly handle audit_notify_watch() in fs/namei.c

On Thursday 26 May 2005 15:46, Timothy R. Chavez wrote: > Is the inode being reported the inode of audit/ or audit.log? OK, its the inode of the directory /var/log/audit But the name doesn't match what the inode points to ! Isn't this a problem?