Audit and file watching

[Steve]

I have been using Audit's file watching ability to monitor when files 
are opened.  I decided to also try to monitor the deletion of files, so 
I told audit to watch for all syscalls pertaining to a particular file. 
   I then tried opening the file, it worked as before.  Then I tried to 
delete the file using 'rm /tmp/test.c' the file was deleted from the 
filesystem, but audit only showed two syscalls being performed: lstat64 
and access.  Audit also sent a message saying:

... audit updated rules specifying watch="/tmp/test.c" ...

lstat64 and access can not delete files on the filesystem, can they?

I expected to see unlink...

Any ideas?

Steve














Jun 14 13:21:06 otslab11 user_actions[8035]: type=1300, payload size=279
Jun 14 13:21:06 otslab11 user_actions[8035]: 
data="audit(1150305665.265:679): arch=40000003 syscall=196 success=yes 
exit=0 a0=bf8c7c49 a1=bf8c6fbc a2=8f1ff4 a3=bf8c7c49 items=1 ppid=7838 
pid=8043 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 
fsgid=0 tty=pts2 comm="rm" exe="/bin/rm" 
subj=user_u:system_r:unconfined_t:s0"
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1307, payload size=43
Jun 14 13:21:06 otslab11 user_actions[8035]: 
data="audit(1150305665.265:679):  cwd="/tmp/test""
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1302, payload size=143
Jun 14 13:21:06 otslab11 user_actions[8035]: 
data="audit(1150305665.265:679): item=0 name="/tmp/test.c" inode=5358237 
dev=03:02 mode=0100644 ouid=0 ogid=0 rdev=00:00 
obj=user_u:object_r:tmp_t:s0"
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1300, payload size=264
Jun 14 13:21:06 otslab11 user_actions[8035]: 
data="audit(1150305665.265:680): arch=40000003 syscall=33 success=yes 
exit=0 a0=bf8c7c49 a1=2 a2=8f1ff4 a3=2 items=1 ppid=7838 pid=8043 
auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 
tty=pts2 comm="rm" exe="/bin/rm" subj=user_u:system_r:unconfined_t:s0"
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1307, payload size=43
Jun 14 13:21:06 otslab11 user_actions[8035]: 
data="audit(1150305665.265:680):  cwd="/tmp/test""
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1302, payload size=143
Jun 14 13:21:06 otslab11 user_actions[8035]: 
data="audit(1150305665.265:680): item=0 name="/tmp/test.c" inode=5358237 
dev=03:02 mode=0100644 ouid=0 ogid=0 rdev=00:00 
obj=user_u:object_r:tmp_t:s0"
Jun 14 13:21:06 otslab11 user_actions[8035]: type=1305, payload size=113
Jun 14 13:21:06 otslab11 user_actions[8035]: 
data="audit(1150305665.265:681): audit updated rules specifying 
watch="/tmp/test.c" with dev=4294967295 ino=4294967295 "