8:48 p.m.
Hi,
I enter the command "sudo cp qwerty /etc/xxx"
and get the reply: "cp: cannot stat `qwerty': No such file or directory."
A number of log entries are written. The last two are, in part:
type=SYSCALL success=yes
type=EXECVE argc=3 a0="cp" a1="qwerty" a2="/etc/xxx"
My problem is with "success=yes".
What is happening?
Thanks - Michael Mather
-----------------------
9:34 p.m.
On Sat, Jul 21, 2012 at 6:48 PM, Michael Mather
<michael.mather(a)teksavvy.com> wrote:
Hi,
I enter the command "sudo cp qwerty /etc/xxx"
and get the reply: "cp: cannot stat `qwerty': No such file or directory."
A number of log entries are written. The last two are, in part:
type=SYSCALL success=yes
type=EXECVE argc=3 a0="cp" a1="qwerty" a2="/etc/xxx"
My problem is with "success=yes".
What's the actual syscall and what's the actual rule that triggering the entry?
What is happening?
Thanks - Michael Mather
-----------------------
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
--
Peter Moody Google 1.650.253.7306
Security Engineer pgp:0xC3410038
10:44 p.m.
On Sat, Jul 21, 2012 at 9:48 PM, Michael Mather
<michael.mather(a)teksavvy.com> wrote:
Hi,
I enter the command "sudo cp qwerty /etc/xxx"
and get the reply: "cp: cannot stat `qwerty': No such file or directory."
A number of log entries are written. The last two are, in part:
type=SYSCALL success=yes
type=EXECVE argc=3 a0="cp" a1="qwerty" a2="/etc/xxx"
My problem is with "success=yes".
What is happening?
Assuming the syscall is execve, then it succeeds because your shell
successfully execve() to run cp.
Then cp the program fails.
12:52 a.m.
From the point of view of the linux kernel, and of the audit, you have
the right to execute the cp, you don't have permission denied. So the
result is success.
Best regards
2012/7/22, Michael Mather <michael.mather(a)teksavvy.com>:
Hi,
I enter the command "sudo cp qwerty /etc/xxx"
and get the reply: "cp: cannot stat `qwerty': No such file or directory."
A number of log entries are written. The last two are, in part:
type=SYSCALL success=yes
type=EXECVE argc=3 a0="cp" a1="qwerty" a2="/etc/xxx"
My problem is with "success=yes".
What is happening?
Thanks - Michael Mather
-----------------------
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
--
Inviato dal mio dispositivo mobile
9:18 a.m.
Thanks for the replies.
The problem is that the PCI requirements say:
10.3 Record at least the following audit trail entries for all system
components for each event:
...
10.3.4 Success or failure indication.
I don't know if PCI would accept the notion that this was success.
Michael
-------
On Sun, 2012-07-22 at 07:52 +0200, yersinia wrote:
>From the point of view of the linux kernel, and of the audit, you
have
the right to execute the cp, you don't have permission denied. So the
result is success.
Best regards
2012/7/22, Michael Mather <michael.mather(a)teksavvy.com>:
> Hi,
>
> I enter the command "sudo cp qwerty /etc/xxx"
> and get the reply: "cp: cannot stat `qwerty': No such file or
directory."
>
> A number of log entries are written. The last two are, in part:
>
> type=SYSCALL success=yes
> type=EXECVE argc=3 a0="cp" a1="qwerty" a2="/etc/xxx"
>
> My problem is with "success=yes".
>
> What is happening?
>
> Thanks - Michael Mather
> -----------------------
>
>
>
> --
> Linux-audit mailing list
> Linux-audit(a)redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
>
5021
days inactive
5021
days old
linux-audit@lists.linux-audit.osci.io
4 comments
4 participants
participants (4)
-
Giang Nguyen -
Michael Mather -
Peter Moody -
yersinia