Absolute path names in PATH records

[Matthew Booth]

On Mon, 2007-07-02 at 16:31 -0400, Valdis.Kletnieks at vt.edu wrote:
> Probably quite a bit, especially if they traverse symlinks and the like.
> Additionally, you'd need to track *current* state of $CWD, as the absolute
> path will change each time a chdir() happens, or if somebody does something
> like 'mv . ../../foo'.  Particularly evil to track:
> 
> cd foo/bar/baz
> ./myprog &
> cd ../
> mv baz ..
> 
> Where's myprog's ../../bin pointing now?  And how would your post processor
> know that happened?

I don't think tracking CWD is an issue as it's already right there in
the same audit event as the PATH record. The question is one of
combining data that's already present in a manner which is easier to
process. E.g.:

type=CWD msg=audit(1183402887.758:2083):  cwd="/root"
type=PATH msg=audit(1183402887.758:2083): item=0 name="/etc/ld.so.cache"
inode=2362196 dev=fd:00 mode=0100644 ouid=0 ogid=0 
rdev=00:00 obj=system_u:object_r:ld_so_cache_t:s0

In this case, /etc/ld.so.cache is already absolute, but there's no
requirement for it to be.

Matt
-- 
Matthew Booth, RHCA, RHCSS
Red Hat, Global Professional Services

M:       +44 (0)7977 267231
GPG ID:  D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20070702/eed0377f/attachment.sig>