Bypassing audit's file watches
Steve
m6x at ornl.gov
Mon Jul 10 11:32:26 UTC 2006
Amy Griffis wrote:
> Steve wrote: [Fri Jul 07 2006, 10:58:42AM EDT]
>> I have found that I can modify files that are being watched and audit
>> not catch it (ie. no events are dispatched). When monitoring a file for
>> all system calls, I can:
>>
>> echo "" > /file/to/watch
>>
>> or
>>
>> cat some_file > /file/to/watch
>>
>> without generating audit events.
>
> Are you seeing the open and not the write, or no records at all?
> If you are missing events for open() calls, please let us know since
> that would be a bug (versus a lacking feature).
I am not seeing the open() or any other syscall records.
Steve
More information about the Linux-audit
mailing list