Re: Why doesn't chown produce an event
On Wed, May 02, 2007 at 11:13:23AM -0400, Robert Evans wrote:
Greetings,
I have the following rule in audit.rules
-a exit,always -S chmod -S chown -S lchown -S fchown -F success!-1 -F
key=mod
If I log in as a typical user and try "chown bob /etc/shadow" I don't get
an event produced, however if I try "chmod 666 /etc/shadow" I do.
What am I missing here?
Thanks!
You need to give 1 systemcall per line I guess.
-a exit,always -S chmod -F success!-1 -F key=mod
-a exit,always -S chown -F success!-1 -F key=mod
-a exit,always -S lchown -F success!-1 -F key=mod
-a exit,always -S fchown -F success!-1 -F key=mod
Ciao, Marcus