<div dir="ltr"><div dir="ltr">Ondra N. <<a href="mailto:ondrysak@gmail.com">ondrysak@gmail.com</a>> po 8. 4. 14:51 (před 3 dny) komu: Paul Hello, below I enclose a reproducer script, hope it helps. #!/bin/bash auditctl -D -k test_key mkdir -p /tmp/random_folder/rzadilLpW4NmB6r2/QzTTUUW6UskKVI9QSk3R/Yrts9nCu0tHVLmLlC3/USAoxzJGnfVwFqOw auditctl -w /tmp/random_folder -p wa -k test_key rm -f /tmp/random_folder/rzadilLpW4NmB6r2/QzTTUUW6UskKVI9QSk3R/Yrts9nCu0tHVLmLlC3/USAoxzJGnfVwFqOw/FP6c2UlcsH5rfInFDyM.file echo "hello" > /tmp/random_folder/rzadilLpW4NmB6r2/QzTTUUW6UskKVI9QSk3R/Yrts9nCu0tHVLmLlC3/USAoxzJGnfVwFqOw/sSmcW4DT7bZ3XS1qcf.file python3 <<< "import os; os.rename('/tmp/random_folder/rzadilLpW4NmB6r2/QzTTUUW6UskKVI9QSk3R/Yrts9nCu0tHVLmLlC3/USAoxzJGnfVwFqOw/sSmcW4DT7bZ3XS1qcf.file','/tmp/random_folder/rzadilLpW4NmB6r2/QzTTUUW6UskKVI9QSk3R/Yrts9nCu0tHVLmLlC3/USAoxzJGnfVwFqOw/FP6c2UlcsH5rfInFDyM.file')" ausearch -i -k test_key | tail ausearch -k test_key --extra-obj2 --format csv | tail | grep renamed Will hopefully try different kernel/userspace combinations later this week. Another thing I noticed is that for me when the file already exists it works as expected. Commenting out the line `rm -f /tmp/random_folder/rzadilLpW4NmB6r2/QzTTUUW6UskKVI9QSk3R/Yrts9nCu0tHVLmLlC3/USAoxzJGnfVwFqOw/FP6c2UlcsH5rfInFDyM.file` from the reproducer script yields expected result after second run. There is a difference in the output in raw that is prolly responsible for the field being empty. WORKS OK file existed before obj2 column is populated with correct value type=PROCTITLE msg=audit(04/08/2019 13:09:54.586:232192) : proctitle=python3 type=PATH msg=audit(04/08/2019 13:09:54.586:232192) : item=4 name=/tmp/random_folder/rzadilLpW4NmB6r2/QzTTUUW6UskKVI9QSk3R/Yrts9nCu0tHVLmLlC3/USAoxzJGnfVwFqOw/FP6c2UlcsH5rfInFDyM.file inode=134231847 dev=fd:01 mode=file,644 ouid=root ogid=root rdev=00:00 objtype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=PATH msg=audit(04/08/2019 13:09:54.586:232192) : item=3 name=/tmp/random_folder/rzadilLpW4NmB6r2/QzTTUUW6UskKVI9QSk3R/Yrts9nCu0tHVLmLlC3/USAoxzJGnfVwFqOw/FP6c2UlcsH5rfInFDyM.file inode=134231846 dev=fd:01 mode=file,644 ouid=root ogid=root rdev=00:00 objtype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=PATH msg=audit(04/08/2019 13:09:54.586:232192) : item=2 name=/tmp/random_folder/rzadilLpW4NmB6r2/QzTTUUW6UskKVI9QSk3R/Yrts9nCu0tHVLmLlC3/USAoxzJGnfVwFqOw/sSmcW4DT7bZ3XS1qcf.file inode=134231847 dev=fd:01 mode=file,644 ouid=root ogid=root rdev=00:00 objtype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=PATH msg=audit(04/08/2019 13:09:54.586:232192) : item=1 name=/tmp/random_folder/rzadilLpW4NmB6r2/QzTTUUW6UskKVI9QSk3R/Yrts9nCu0tHVLmLlC3/USAoxzJGnfVwFqOw/ inode=134237250 dev=fd:01 mode=dir,755 ouid=root ogid=root rdev=00:00 objtype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=PATH msg=audit(04/08/2019 13:09:54.586:232192) : item=0 name=/tmp/random_folder/rzadilLpW4NmB6r2/QzTTUUW6UskKVI9QSk3R/Yrts9nCu0tHVLmLlC3/USAoxzJGnfVwFqOw/ inode=134237250 dev=fd:01 mode=dir,755 ouid=root ogid=root rdev=00:00 objtype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=CWD msg=audit(04/08/2019 13:09:54.586:232192) : cwd=/tmp type=SYSCALL msg=audit(04/08/2019 13:09:54.586:232192) : arch=x86_64 syscall=rename success=yes exit=0 a0=0x7ffbd89d3510 a1=0x7ffbd89d35a8 a2=0xffffffff a3=0x7ffd9b558b20 items=5 ppid=27771 pid=27779 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=10320 comm=python3 exe=/opt/rh/rh-python36/root/usr/bin/python3.6 key=test_key DOES NOT WORK OK file did not exist before and obj2 column remains empty type=PROCTITLE msg=audit(04/08/2019 13:12:12.685:232285) : proctitle=python3 type=PATH msg=audit(04/08/2019 13:12:12.685:232285) : item=3 name=/tmp/random_folder/rzadilLpW4NmB6r2/QzTTUUW6UskKVI9QSk3R/Yrts9nCu0tHVLmLlC3/USAoxzJGnfVwFqOw/FP6c2UlcsH5rfInFDyM.file inode=134231846 dev=fd:01 mode=file,644 ouid=root ogid=root rdev=00:00 objtype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=PATH msg=audit(04/08/2019 13:12:12.685:232285) : item=2 name=/tmp/random_folder/rzadilLpW4NmB6r2/QzTTUUW6UskKVI9QSk3R/Yrts9nCu0tHVLmLlC3/USAoxzJGnfVwFqOw/sSmcW4DT7bZ3XS1qcf.file inode=134231846 dev=fd:01 mode=file,644 ouid=root ogid=root rdev=00:00 objtype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=PATH msg=audit(04/08/2019 13:12:12.685:232285) : item=1 name=/tmp/random_folder/rzadilLpW4NmB6r2/QzTTUUW6UskKVI9QSk3R/Yrts9nCu0tHVLmLlC3/USAoxzJGnfVwFqOw/ inode=134237250 dev=fd:01 mode=dir,755 ouid=root ogid=root rdev=00:00 objtype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=PATH msg=audit(04/08/2019 13:12:12.685:232285) : item=0 name=/tmp/random_folder/rzadilLpW4NmB6r2/QzTTUUW6UskKVI9QSk3R/Yrts9nCu0tHVLmLlC3/USAoxzJGnfVwFqOw/ inode=134237250 dev=fd:01 mode=dir,755 ouid=root ogid=root rdev=00:00 objtype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=CWD msg=audit(04/08/2019 13:12:12.685:232285) : cwd=/tmp type=SYSCALL msg=audit(04/08/2019 13:12:12.685:232285) : arch=x86_64 syscall=rename success=yes exit=0 a0=0x7f52063c2510 a1=0x7f52063c25a8 a2=0xffffffff a3=0x7ffdb7446700 items=4 ppid=28069 pid=28078 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=10320 comm=python3 exe=/opt/rh/rh-python36/root/usr/bin/python3.6 key=test_key </div><div dir="ltr"> </div><div>Hope it helps </div></div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">ne 7. 4. 2019 v 10:18 odesílatel Steve Grubb <<a href="mailto:sgrubb@redhat.com">sgrubb@redhat.com</a>> napsal: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Fri, 5 Apr 2019 16:30:32 +0200 "Ondra N." <<a href="mailto:ondrysak@gmail.com" target="_blank">ondrysak@gmail.com</a>> wrote: > it seems that the option fails to display the second object for rename > action. To catch everyone up, it turns out this is audit-2.8.4 and kernel 3.10.0-957.el7.x86_64. > interactive format correctly show renaming the file > 5M2w0d4eagxxig9KYM5.file to DyTbnH12dMV1nQsOxU.file > > ausearch -k test-ra -i > > type=PROCTITLE msg=audit(04/05/2019 13:57:22.489:110873) : > proctitle=python3 populate_fs.py rename > type=PATH msg=audit(04/05/2019 13:57:22.489:110873) : item=3 > name=/tmp/rnd_pop/I2wt8yFylHdNJdX8/sesvPVcmFUDDBp1Pc/5yqohyxiGYwSzXwYRN2/93qyvIU9V2O8dsDXSdQP/csE7ryqvCWMBd8ASyJ3e/DyTbnH12dMV1nQsOxU.file > inode=184553858 dev=fd:01 mode=file,644 ouid=root ogid=root rdev=00:00 > objtype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 There seems to be a missing DELETE path record here. What I see on my system is 2 PARENT records, 2 DELETE records, and 1 CREATE record. The two parents is for both items (obj1 & obj2). Then both objects get deleted, and we are left with 1 object being created. This last create record is what OBJ2 would be. Without the second DELETE, we wind up on the wrong record looking for 'name'. Looking at the inodes, what is missing is the DELETE for the inode that is being replaced with the tmp copy. Funny thing is, this works fine for me on the same user space and kernel. Can you pass along a simplified reproducer? Shell script would be preferred. Thanks, -Steve > type=PATH msg=audit(04/05/2019 13:57:22.489:110873) : item=2 > name=/tmp/rnd_pop/I2wt8yFylHdNJdX8/sesvPVcmFUDDBp1Pc/5yqohyxiGYwSzXwYRN2/93qyvIU9V2O8dsDXSdQP/csE7ryqvCWMBd8ASyJ3e/5M2w0d4eagxxig9KYM5.file > inode=184553858 dev=fd:01 mode=file,644 ouid=root ogid=root rdev=00:00 > objtype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 > type=PATH msg=audit(04/05/2019 13:57:22.489:110873) : item=1 > name=/tmp/rnd_pop/I2wt8yFylHdNJdX8/sesvPVcmFUDDBp1Pc/5yqohyxiGYwSzXwYRN2/93qyvIU9V2O8dsDXSdQP/csE7ryqvCWMBd8ASyJ3e/ > inode=184554064 dev=fd:01 mode=dir,755 ouid=root ogid=root rdev=00:00 > objtype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 > type=PATH msg=audit(04/05/2019 13:57:22.489:110873) : item=0 > name=/tmp/rnd_pop/I2wt8yFylHdNJdX8/sesvPVcmFUDDBp1Pc/5yqohyxiGYwSzXwYRN2/93qyvIU9V2O8dsDXSdQP/csE7ryqvCWMBd8ASyJ3e/ > inode=184554064 dev=fd:01 mode=dir,755 ouid=root ogid=root rdev=00:00 > objtype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 > type=CWD msg=audit(04/05/2019 13:57:22.489:110873) : > cwd=/push_agent/src/main/python/scripts > type=SYSCALL msg=audit(04/05/2019 13:57:22.489:110873) : arch=x86_64 > syscall=rename success=yes exit=0 a0=0x7f3259691b78 a1=0x7f3259691d70 > a2=0xffffffff a3=0x7f3263f160e0 items=4 ppid=27421 pid=7653 auid=root > uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root > fsgid=root tty=pts1 ses=5549 comm=python3 > exe=/opt/rh/rh-python36/root/usr/bin/python3.6 key=test-ra > > but csv format shows just empty column where the info about the > object2 should be. > > ausearch -k test-ra --format csv --extra-obj2 > > ,SYSCALL,04/05/2019,13:57:22,110873,audit-rule,5549,root,root,priviliged-acct,renamed,success,/tmp/rnd_pop/I2wt8yFylHdNJdX8/sesvPVcmFUDDBp1Pc/5yqohyxiGYwSzXwYRN2/93qyvIU9V2O8dsDXSdQP/csE7ryqvCWMBd8ASyJ3e/5M2w0d4eagxxig9KYM5.file,184553858,,file,/opt/rh/rh-python36/root/usr/bin/python3.6 > > is this desired behaviour? </blockquote></div>