<blockquote class="gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>Hi,</div><div>
<br></div><div>I am using redhat 6, and trying to create logs for some system call using the rule given below:</div><div><br></div><div><b>-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod</b></div>
<div><br></div><div>-> After running command chmod i was not able to get any log, but when i used strace command i have seen that syscall have been called.</div><div>-> I also checked that auditd service is running properly.</div>
<div>-> May you guide me why i am not able to get any log message.</div><div>-> I also checked by writting rule for 32 bit, but problem still not resolved.</div><font color="#888888"><div><br></div></font></blockquote>
<div><br></div><div><br></div><div>->When i have run the command "auditctl -l |grep chmod" i got the output as given below:</div><div><br></div><div> LIST_RULES: exit,always arch=1073741827 (0x40000003) auid>=500 (0x1f4) auid!=-1 (0xffffffff) key=perm_mod syscall=chmod,fchmod,fchmodat</div>
<div> LIST_RULES: exit,always arch=3221225534 (0xc000003e) auid>=500 (0x1f4) auid!=-1 (0xffffffff) key=perm_mod syscall=chmod,fchmod,fchmodat</div><div><br></div><div><br></div><div>-> when i am using strace command it is showing that "fchmodat" system call have been called and i have included that in my rule but still i am not getting any log. strace command and its output is given below:</div>
<div><br></div><div><b>Command</b> : strace -o /root/bharat/chmodSystemCallOutput.txt chmod 765 /root/bharat/test02</div><div><br></div><div><b>Output</b>:</div><div><br></div><div><div>execve("/bin/chmod", ["chmod", "765", "/root/bharat/test02"], [/* 31 vars */]) = 0</div>
<div>brk(0) = 0xdbe000</div><div>mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa36aaa2000</div><div>access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)</div>
<div>open("/etc/ld.so.cache", O_RDONLY) = 3</div><div>fstat(3, {st_mode=S_IFREG|0644, st_size=70036, ...}) = 0</div><div>mmap(NULL, 70036, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fa36aa90000</div><div>close(3) = 0</div>
<div>open("/lib64/libc.so.6", O_RDONLY) = 3</div><div>read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260\355\1\0\0\0\0\0"..., 832) = 832</div><div>fstat(3, {st_mode=S_IFREG|0755, st_size=1907344, ...}) = 0</div>
<div>mmap(NULL, 3737768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fa36a4f3000</div><div>mprotect(0x7fa36a67a000, 2097152, PROT_NONE) = 0</div><div>mmap(0x7fa36a87a000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x187000) = 0x7fa36a87a000</div>
<div>mmap(0x7fa36a87f000, 18600, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fa36a87f000</div><div>close(3) = 0</div><div>mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa36aa8f000</div>
<div>mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa36aa8e000</div><div>mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa36aa8d000</div><div>arch_prctl(ARCH_SET_FS, 0x7fa36aa8e700) = 0</div>
<div>mprotect(0x7fa36a87a000, 16384, PROT_READ) = 0</div><div>mprotect(0x7fa36aaa3000, 4096, PROT_READ) = 0</div><div>munmap(0x7fa36aa90000, 70036) = 0</div><div>brk(0) = 0xdbe000</div>
<div>brk(0xddf000) = 0xddf000</div><div>open("/usr/lib/locale/locale-archive", O_RDONLY) = 3</div><div>fstat(3, {st_mode=S_IFREG|0644, st_size=99158752, ...}) = 0</div><div>mmap(NULL, 99158752, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fa364662000</div>
<div>close(3) = 0</div><div>umask(0) = 077</div><div>stat("/root/bharat/test02", {st_mode=S_IFREG|0777, st_size=18, ...}) = 0</div><div>fchmodat(AT_FDCWD, "/root/bharat/test02", 0765) = 0</div>
<div>close(1) = 0</div><div>close(2) = 0</div><div>exit_group(0) </div></div><div><br></div><div><br></div><div><br></div>-- <br><div>Bharat Gupta </div>
<span style>IIT -Roorkee</span><br style>
<br><br>