11 p.m.
I'm running CentOS-6.5-i386-minimal.
I recently used auditd to setup a watch on a specific file (-w /path/to/my/file -p warx),
but found it difficult to distinguish system calls that were modifying the file vs.
reading from the file when using ausearch/aureport.
In response to that, I separated out the watches by keys:
-w /patch/to/my/file -p wa thisisawrite
-w /path/to/my/file -p r thisisaread
And then ran both aureport -k and aureport -f to join the keys to the system calls by
event number.
Am I wholly approaching this the wrong way, or is there an easier way to distinguish
between a syscall that reads from a file vs. writes to a file?
Assuming this is the correct approach, would there then be a benefit to adding the key to
the aureport -f output? I find it awkward to have to combine the two commands to get the
necessary information.
Regards,
Jon Smith
3:24 p.m.
On Wednesday, July 09, 2014 04:00:18 AM Jon Smith wrote:
I recently used auditd to setup a watch on a specific file (-w
/path/to/my/file -p warx), but found it difficult to distinguish system
calls that were modifying the file vs. reading from the file when using
ausearch/aureport.
In response to that, I separated out the watches by keys:
-w /patch/to/my/file -p wa thisisawrite
-w /path/to/my/file -p r thisisaread
This sounds like the correct way to do it.
And then ran both aureport -k and aureport -f to join the keys to the
system
calls by event number.
Why not use ausearch -k? You can also give a partial key name since partial
matching is the default. You could use: ausearch --start today -k thisisa
Am I wholly approaching this the wrong way, or is there an easier way
to
distinguish between a syscall that reads from a file vs. writes to a file?
Well, what you are getting is the requested permissions, rather than actual
use of the permissions. I think it can be assumed that if an app opens a file
for write, it will eventually get around to that. But not always.
Assuming this is the correct approach, would there then be a benefit
to
adding the key to the aureport -f output? I find it awkward to have to
combine the two commands to get the necessary information.
No one has asked for that so far. There is one quirk about keys, you can have
multiple keys for the same event. So, that could be a bit of text if you have
several. The idea of aureport was to have a utility that can extract, total,
and sort properties of the event.
-Steve
9:19 p.m.
Steve,
I just wanted to thank you for your reply. I totally overlooked the ability to pipe
ausearch output to aureport, so the end result looked like this:
ausearch -k thisisawrite | aureport -f
And that solved my problem.
Thank you very much for your time.
Regards,
Jon Smith
-----Original Message-----
From: Steve Grubb [mailto:sgrubb@redhat.com]
Sent: Thursday, July 10, 2014 1:25 PM
To: linux-audit(a)redhat.com
Cc: Jon Smith
Subject: Re: file watch: separating file reads and writes
On Wednesday, July 09, 2014 04:00:18 AM Jon Smith wrote:
I recently used auditd to setup a watch on a specific file (-w
/path/to/my/file -p warx), but found it difficult to distinguish
system calls that were modifying the file vs. reading from the file
when using ausearch/aureport.
In response to that, I separated out the watches by keys:
-w /patch/to/my/file -p wa thisisawrite -w /path/to/my/file -p r
thisisaread
This sounds like the correct way to do it.
And then ran both aureport -k and aureport -f to join the keys to the
system calls by event number.
Why not use ausearch -k? You can also give a partial key name since partial matching is
the default. You could use: ausearch --start today -k thisisa
Am I wholly approaching this the wrong way, or is there an easier way
to
distinguish between a syscall that reads from a file vs. writes to a file?
Well, what you are getting is the requested permissions, rather than actual
use of the permissions. I think it can be assumed that if an app opens a file
for write, it will eventually get around to that. But not always.
Assuming this is the correct approach, would there then be a benefit
to
adding the key to the aureport -f output? I find it awkward to have to
combine the two commands to get the necessary information.
No one has asked for that so far. There is one quirk about keys, you can have
multiple keys for the same event. So, that could be a bit of text if you have
several. The idea of aureport was to have a utility that can extract, total,
and sort properties of the event.
-Steve
4019
days inactive
4032
days old
linux-audit@lists.linux-audit.osci.io
2 comments
2 participants
participants (2)
-
Jon Smith -
Steve Grubb