Re: audit.19 kernel

linux-audit-bounces(a)redhat.com wrote on 04/06/2005 10:41:06 AM: I am seeing an inconsistent behavior when testing the watches with this kernel. Is anybody else encountering something similar? Below you will find the manual steps I am performing, and they only generate two records (for the first touch, and the remove). I also tried to set permissions to "reaw" to ensure I get all records, but that didn't help either. [root@checkered objident]# uname -a Linux checkered.ltc.austin.ibm.com 2.6.9-5.0.3.EL.audit.19 #1 Wed Apr 6 09:10:02 EDT 2005 i686 i686 i386 GNU/Linux [root@checkered objident]# rpm -qa | grep audit audit-libs-0.6.10-1 audit-0.6.10-1 kernel-2.6.9-5.0.3.EL.audit.19 audit-libs-devel-0.6.10-1 [root@checkered lib]# auditctl -w /tmp/test_file -k file-key No rules [root@checkered lib]# touch /tmp/test_file [root@checkered lib]# cat /tmp/test_file [root@checkered lib]# cp /tmp/test_file /tmp/something [root@checkered lib]# touch /tmp/test_file [root@checkered lib]# cp /tmp/something /tmp/test_file cp: overwrite `/tmp/test_file'? y [root@checkered lib]# rm /tmp/test_file rm: remove regular empty file `/tmp/test_file'? y type=KERNEL msg=audit(1112950099.362:0): audit_enabled=1 old=1 by auid 4294967295 type=KERNEL msg=audit(1112950147.072:4062817): item=0 name="/tmp/test_file" inode=2223873 dev=fd:00 mode=041777 uid=0 gid=0 rdev=00:00 type=KERNEL msg=audit(1112950147.072:4062817): auxitem=1 name="test_file" filterkey=file-key perm=0 perm_mask=2 inode=2224460 inode_uid=0 inode_gid=0 inode_dev=fd:00 inode_rdev=00:00 type=KERNEL msg=audit(1112950147.072:4062817): syscall=5 arch=40000003 success=yes exit=3 a0=bff7cbb2 a1=8941 a2=1b6 a3=8941 items=1 pid=4538 loginuid=-1 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="touch" exe=/bin/touch type=KERNEL msg=audit(1112950218.048:4070039): item=0 name="/tmp/test_file" inode=2223873 dev=fd:00 mode=041777 uid=0 gid=0 rdev=00:00 type=KERNEL msg=audit(1112950218.048:4070039): auxitem=1 name="test_file" filterkey=file-key perm=0 perm_mask=2 inode=2224460 inode_uid=0 inode_gid=0 inode_dev=fd:00 inode_rdev=00:00 type=KERNEL msg=audit(1112950218.048:4070039): syscall=10 arch=40000003 success=yes exit=0 a0=bffa1bb8 a1=0 a2=80505e4 a3=bffa1bb8 items=1 pid=4543 loginuid=-1 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="rm" exe=/bin/rm - Loulwa