<div class="gmail_quote">---------- Forwarded message ---------- From: 4javier <<a href="mailto:4javiereg4@gmail.com">4javiereg4@gmail.com</a>> Date: 2011/6/2 Subject: Re: Possible regression To: Steve Grubb <<a href="mailto:sgrubb@redhat.com">sgrubb@redhat.com</a>> you're right...sorry for my fault... I didn't use the -a switch. I read the man, but I cannot understand how this settings is able to fix the problem with O_CREAT. Could you explain that to me, please?<div><div></div><div class="h5"> <div class="gmail_quote">2011/6/2 Steve Grubb <<a href="mailto:sgrubb@redhat.com" target="_blank">sgrubb@redhat.com</a>> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div>On Thursday, June 02, 2011 08:48:30 AM 4javier wrote: > I'm noticing exactly the same problem mentioned into this old message > <a href="http://osdir.com/ml/linux.redhat.security.audit/2006-07/msg00036.html" target="_blank">http://osdir.com/ml/linux.redhat.security.audit/2006-07/msg00036.html</a> > Workaround consisting into watching the whole directory containing the file > works too. I've found that into 2006 a patch was submitted to solve the > issue > <a href="http://www.mail-archive.com/linux-audit@redhat.com/msg00476.html" target="_blank">http://www.mail-archive.com/linux-audit@redhat.com/msg00476.html</a> > > Is this a recent regression, or is there something I don't know? </div>I just ran the test from that email and got the following: [root@localhost ~]# touch /tmp/test [root@localhost ~]# auditctl -a always,exit -F path=/tmp/test -F perm=rwa -k watch [root@localhost ~]# echo "" > /tmp/test [root@localhost ~]# cat /tmp/test [root@localhost ~]# ausearch --start recent --key watch -i ---- type=CONFIG_CHANGE msg=audit(06/02/2011 09:15:49.790:124) : auid=sgrubb ses=2 subj=unconfined_u:unconfined_r:auditctl_t:s0-s0:c0.c1023 op="add rule" key=watch list=exit res=1 ---- type=PATH msg=audit(06/02/2011 09:15:56.970:125) : item=0 name=/tmp/test inode=164740 dev=fd:01 mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 type=CWD msg=audit(06/02/2011 09:15:56.970:125) : cwd=/root type=SYSCALL msg=audit(06/02/2011 09:15:56.970:125) : arch=x86_64 syscall=open success=yes exit=3 a0=28cadd0 a1=241 a2=1b6 a3=0 items=1 ppid=1634 pid=1640 auid=sgrubb uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts1 ses=2 comm=bash exe=/bin/bash subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=watch ---- type=PATH msg=audit(06/02/2011 09:16:08.850:126) : item=0 name=/tmp/test inode=164740 dev=fd:01 mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 type=CWD msg=audit(06/02/2011 09:16:08.850:126) : cwd=/root type=SYSCALL msg=audit(06/02/2011 09:16:08.850:126) : arch=x86_64 syscall=open success=yes exit=3 a0=7fffd7a8f943 a1=0 a2=0 a3=32d80819d0 items=1 ppid=1640 pid=1659 auid=sgrubb uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts1 ses=2 comm=cat exe=/bin/cat subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=watch [root@localhost ~]# uname -r 2.6.38.6-26.rc1.fc15.x86_64 We have 2 events. Are you getting this? Is something missing? -Steve </blockquote></div> </div></div></div>