Re: file watch: separating file reads and writes
On Wednesday, July 09, 2014 04:00:18 AM Jon Smith wrote:
I recently used auditd to setup a watch on a specific file (-w
/path/to/my/file -p warx), but found it difficult to distinguish system
calls that were modifying the file vs. reading from the file when using
ausearch/aureport.
In response to that, I separated out the watches by keys:
-w /patch/to/my/file -p wa thisisawrite
-w /path/to/my/file -p r thisisaread
This sounds like the correct way to do it.
And then ran both aureport -k and aureport -f to join the keys to the
system
calls by event number.
Why not use ausearch -k? You can also give a partial key name since partial
matching is the default. You could use: ausearch --start today -k thisisa
Am I wholly approaching this the wrong way, or is there an easier way
to
distinguish between a syscall that reads from a file vs. writes to a file?
Well, what you are getting is the requested permissions, rather than actual
use of the permissions. I think it can be assumed that if an app opens a file
for write, it will eventually get around to that. But not always.
Assuming this is the correct approach, would there then be a benefit
to
adding the key to the aureport -f output? I find it awkward to have to
combine the two commands to get the necessary information.
No one has asked for that so far. There is one quirk about keys, you can have
multiple keys for the same event. So, that could be a bit of text if you have
several. The idea of aureport was to have a utility that can extract, total,
and sort properties of the event.
-Steve