watch dir problem

[Timothy R. Chavez]

On Thursday 26 May 2005 14:46, Timothy R. Chavez wrote:
> On Thursday 26 May 2005 14:39, Steve Grubb wrote:
> > Hello,
> > 
> > I got a capture of audit doing a log rotate using:
> > 
> > auditctl -w /var/log -k dir -p rwea
> > 
> > type=SYSCALL msg=audit(05/26/05 15:24:55.023:13588534) : arch=i386 
> > syscall=rename success=yes exit=0 a0=94bc008 a1=94bc028 a2=8051254 a3=8054e00 
> > items=2 pid=1716 auid=unknown(4294967295) uid=root gid=root euid=root 
> > suid=root fsuid=root egid=root sgid=root fsgid=root comm=auditd 
> > exe=/sbin/auditd
> > type=FS_WATCH msg=audit(05/26/05 15:24:55.023:13588534) :  watch=log 
> > filterkey=dir perm=read,write,exec,append perm_mask=exec inode=29249 
> > inode_uid=root inode_gid=root inode_dev=03:07 inode_rdev=00:00
> > type=FS_WATCH msg=audit(05/26/05 15:24:55.023:13588534) :  watch=log 
> > filterkey=dir perm=read,write,exec,append perm_mask=exec inode=29249 
> > inode_uid=root inode_gid=root inode_dev=03:07 inode_rdev=00:00
> > type=PATH msg=audit(05/26/05 15:24:55.023:13588534) : item=0 
> > name=/var/log/audit/audit.log inode=29307 dev=03:07 mode=dir,750 ouid=root 
> > ogid=root rdev=00:00
> > type=PATH msg=audit(05/26/05 15:24:55.023:13588534) : item=1 
> > name=/var/log/audit/audit.log.1 inode=29307 dev=03:07 mode=dir,750 ouid=root 
> > ogid=root rdev=00:00
> > 
> > The thing I'm wondering about is the mode not matching the object in PATH. The 
> > watch is on a dir, but the item listed is not a dir, its a file with access 
> > perms of 0640.
> 
> Is the inode being reported the inode of audit/ or audit.log?
> 

I suspect that it is.  The way that path is being formed is from

sys_rename()->do_rename() right??

> static inline int do_rename(const char * oldname, const char * newname)
> {
>         int error = 0;
>         struct dentry * old_dir, * new_dir;
>         struct dentry * old_dentry, *new_dentry;
>         struct dentry * trap;
>         struct nameidata oldnd, newnd;
>                                                                                                                                                                      
>         error = path_lookup(oldname, LOOKUP_PARENT, &oldnd);
>         if (error)
>                 goto exit;
>                                                                                                                                                                      
>         error = path_lookup(newname, LOOKUP_PARENT, &newnd);
>         if (error)
>                 goto exit1;
                                                                                                                                                                     
If this is true, as you can see, we only ever do a lookup on our parent.  So the
inode information (and mode) will be for our parent.

If you were to do a "unlink" you'd see something similar in that the inode reported
with the path is the inode of it's parent directory.

This is my theory, at least.

-tim