Re: AuditRule Questions

On Tuesday, January 19, 2021 8:15:33 AM EST Joe Wulf wrote: > 1. In audit rules 2.8.5 (front portion of the rules):> > > > ## Unsuccessful file access (any other opens) This has to go last.> > -a always,exit -F arch=b32 -S> > open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES-a> > always,exit -F arch=b64 -S> > open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES-a> > always,exit -F arch=b32 -S> > open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM-a> > always,exit -F arch=b64 -S> > open,creat,truncate,ftruncate,openat,open_by_handle_at  -F exit=-EPERM> > Whereas in audit rules 3.0, the same portion of the same rules looks like:> > -a always,exit -F arch=b32 -S> > open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES-a> > always,exit -F arch=b32 -S> > open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM-a> > always,exit -F arch=b64 -S> > open,truncate,ftruncate,creat,openat,open_by_handle_at -F exit=-EACCES-a> > always,exit -F arch=b64 -S> > open,truncate,ftruncate,creat,openat,open_by_handle_at  -F exit=-EPERM> > > > The ordering of the syscalls differs between the two, as well as the> > sequential order of the rules themselves. I better understand that the> > first audit-rule matched 'wins'.-  Please help me understand the reason> > for the change in sequence, but also for the change in the order of the> > syscalls (i.e. between 2.8.5 and 3.0).> > There were several 3.0 alpha releases. I'm not sure which one you are calling > 3.0. Because I can't find an exact match. Based on the text above, I do not > see the syscall ordering changed at all. The only thing that I see is in > 2.8.5 they are grouped by exit code whereas 3.0 is grouped by arch. Since > this group of rules all have the same key, they are working as a team. That > means that what matters is the placement of this group of rules relative to > other groups of rules is what matters. In both cases a syscall can ever only > match one of them - the exit code either is or isn't EPERM, it either is or > isn't b32.> <snip>> -Steve