Re: Logging failed open() calls on /var/log/audit/audit.log
Alexander Viro wrote:
On Tue, Jun 27, 2006 at 05:36:43PM -0400, Linda Knippers wrote:
>Steve Grubb wrote:
>
>>On Tuesday 27 June 2006 17:15, Amy Griffis wrote:
>>
>>
>>>If you would like to see a record in this case, you must add a watch
>>>for /var/log/audit.
>>
>>
>>I don't see a record watching this either.
>
>I think we're missing the directory lookup syscall(s) on watches
>right now.
Careful - that's one hell of a hot path. Note that we'll get many of
those for each syscall that does pathname resolution; moreover, when
we hit dcache, we should be careful about blocking.
Maybe its not actually the lookup we need. If I do this on RHEL4
I get an audit record for an open failure on /var/log/audit.
With the .34 lspp kernel and the 1.2.2 audit tools, I don't get
a record for a failed open, even though open seems to be registered
with the watch.
[root@cert-e2 kernel]# /sbin/auditctl -l
LIST_RULES: exit,always watch=/var/log/audit/audit.log (0x18)
syscall=open,truncate,ftruncate,rename,mkdir,rmdir,creat,link,unlink,symlink,chmod,fchmod,chown,fchown,lchown
LIST_RULES: exit,always watch=/var/log/audit (0xe)
syscall=open,truncate,ftruncate,rename,mkdir,rmdir,creat,link,unlink,symlink,chmod,fchmod,chown,fchown,lchown
-- ljk