Re: auditd not triggering ANOM_ROOT_TRANS record

On Oct 25, 2016 06:48, "William Roberts" <bill.c.roberts(a)gmail.com&gt; wrote: somewhere it's likely executing some setuid root thing that it modifies. Take a peak with strace. Sorry too early in the morning for me, this doesn't require setuid modification, just a file owned by root looking at the source: https://github.com/dirtycow/dirtycow.github.io/blob/master/dirtyc0w.c https://www.google.com/amp/www.theregister.co.uk/AMP/2016/10/21/linux_pri... wrote: with 30-pci-dss-v31.rules. I was expecting an ANOM_ROOT_TRANS record but didn't get one. What triggers an ANOM_ROOT_TRANS record? What then is the best way to trivially audit for a successful privilege escalation? binary, you won't see anything. As far as that record goes, I have no idea, I'll let an auditing expert answer that question.