Bypassing audit's file watches

[Michael C Thompson]

Timothy R. Chavez wrote:
> On Fri, 2006-07-07 at 10:58 -0400, Steve wrote:
>> I have found that I can modify files that are being watched and audit 
>> not catch it (ie. no events are dispatched).  When monitoring a file for 
>> all system calls, I can:
>>
>> echo "" > /file/to/watch
>>
>> or
>>
>> cat some_file > /file/to/watch
>>
>> without generating audit events.  I assume this has to do with how the 
>> kernel handles re-direction.  Is it possible to catch these modifications?
>>
>> Thanks,
>> Steve
> 
> What are your rules?  You should catch these on open()
> of /file/to/watch, right?
> 
> -tim

I am seeing this as well with the .42 kernel and audit-1.2.4-1. Not sure 
when this might have broken, but its broke now.

It seems if you set a watch on /file/to (to use your example above), 
then you are getting the opens that bash does, although the PATH record 
shows the item as "/file/to/watch".

So watching the parent directory will audit redirect shell magic, but 
watching the target of that redirection will not audit that same magic.

Mike