I'm running the capp rules on my ia64 box with the .84 kernel and the 1.0.1 tools and I'm seeing audit records for things that I don't think I should be seeing them for. With a watch rule like this: -w /etc/group -p wa -k CFG_group with the associated syscall rules in the capp rules file, should I only be getting records when someone writes or appends to the group file? That's what I think the -p options mean but I'm getting audit records anytime someone does anything to the group file, including just access()ing it. The same is true for other watched files. With a little test program that does a read access check on any file, I always get a set of audit records like this when I do it on a watched file. type=SYSCALL msg=audit(1123283719.207:502): arch=c0000032 syscall=1049 success=yes exit=0 a0=60000fffffffb935 a1=4 a2=60000fffffffb935 a3=4 items=1 pid=4230 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="t_path" exe="/home/ljk/t_path" type=FS_INODE msg=audit(1123283719.207:502): inode=559722 inode_uid=0 inode_gid=0 inode_dev=08:13 inode_rdev=00:00 type=CWD msg=audit(1123283719.207:502): cwd="/home/ljk" type=PATH msg=audit(1123283719.207:502): name="/etc/group" flags=401 inode=559722 dev=08:13 mode=0100644 ouid=0 ogid=0 rdev=00:00 Should that be happening? My little test program and output of an auditctl -v are attached. -- ljk AUDIT_LIST: entry,possible syscall=chmod AUDIT_LIST: entry,possible syscall=fchmod AUDIT_LIST: entry,possible syscall=chown AUDIT_LIST: entry,possible syscall=fchown AUDIT_LIST: entry,possible syscall=lchown AUDIT_LIST: entry,possible syscall=creat AUDIT_LIST: entry,possible syscall=open AUDIT_LIST: entry,possible syscall=truncate AUDIT_LIST: entry,possible syscall=ftruncate AUDIT_LIST: entry,possible syscall=mkdir AUDIT_LIST: entry,possible syscall=rmdir AUDIT_LIST: entry,possible syscall=unlink AUDIT_LIST: entry,possible syscall=rename AUDIT_LIST: entry,possible syscall=link AUDIT_LIST: entry,possible syscall=symlink AUDIT_LIST: entry,always syscall=mknod AUDIT_LIST: entry,always syscall=mount AUDIT_LIST: entry,always syscall=umount AUDIT_LIST: entry,always syscall=adjtimex AUDIT_LIST: entry,always syscall=settimeofday AUDIT_LIST: entry,possible syscall=execve AUDIT_WATCH_LIST: dev=8:19, path=/var/log/audit, filterkey=LOG_audit, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/var/log/audit/audit_log, filterkey=LOG_audit_log, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/var/log/audit/audit_log.1, filterkey=LOG_audit_log, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/var/log/audit/audit_log.2, filterkey=LOG_audit_log, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/var/log/audit/audit_log.3, filterkey=LOG_audit_log, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/var/log/audit/audit_log.4, filterkey=LOG_audit_log, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/auditd.conf, filterkey=CFG_auditd.conf, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/audit.rules, filterkey=CFG_audit.rules, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/usr/sbin/stunnel, filterkey=, perms=x, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/var/spool/at, filterkey=LOG_at, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/at.allow, filterkey=CFG_at.allow, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/at.deny, filterkey=CFG_at.deny, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/cron.allow, filterkey=CFG_cron.allow, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/cron.deny, filterkey=CFG_cron.deny, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/cron.d, filterkey=CFG_cron.d, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/cron.daily, filterkey=CFG_cron.daily, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/cron.hourly, filterkey=CFG_cron.hourly, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/cron.monthly, filterkey=CFG_cron.monthly, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/cron.weekly, filterkey=CFG_cron.weekly, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/crontab, filterkey=CFG_crontab, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/var/spool/cron/root, filterkey=CFG_crontab_root, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/group, filterkey=CFG_group, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/passwd, filterkey=CFG_passwd, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/gshadow, filterkey=CFG_gshadow, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/shadow, filterkey=CFG_shadow, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/security/opasswd, filterkey=CFG_opasswd, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/login.defs, filterkey=CFG_login.defs, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/securetty, filterkey=CFG_securetty, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/var/log/faillog, filterkey=LOG_faillog, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/var/log/lastlog, filterkey=LOG_lastlog, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/hosts, filterkey=CFG_hosts, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/sysconfig, filterkey=, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/inittab, filterkey=CFG_inittab, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/rc.d/init.d, filterkey=, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/rc.d/init.d/auditd, filterkey=CFG_initd_auditd, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/ld.so.conf, filterkey=CFG_ld.so.conf, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/localtime, filterkey=CFG_localtime, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/sysctl.conf, filterkey=CFG_sysctl.conf, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/modprobe.conf, filterkey=CFG_modprobe.conf, perms=wa, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/pam.d, filterkey=, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/ssh/sshd_config, filterkey=CFG_sshd_config, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/stunnel/stunnel.conf, filterkey=CFG_stunnel.conf, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/stunnel/stunnel.pem, filterkey=CFG_stunnel.pem, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/vsftpd.ftpusers, filterkey=CFG_vsftpd.ftpusers, perms=, valid=0 AUDIT_WATCH_LIST: dev=8:19, path=/etc/vsftpd/vsftpd.conf, filterkey=CFG_vsftpd.conf, perms=, valid=0 #include <signal.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <string.h> #include <errno.h> int main(int argc, char *argv[]) { int i, cnt = 1; int mode=R_OK; char *path="/etc/passwd"; if (argc > 1) { path = argv[1]; } if (argc > 2) { cnt = atoi(argv[2]); if (cnt <=0) cnt = 1; } printf("looping %d times on access(%s, %o)\n", cnt, path, mode); for (i = 0; i < cnt; i++) { if (access(path, mode) < 0) { fprintf(stderr, "access(%s, %o): %s\n", path,mode,strerror(errno)); } } exit(0); }