A question about the directory watch in audit_tree.c in kernel

[Steve Grubb]

On Tuesday 20 May 2008 21:47:59 zhangxiliang wrote:
> Sorry, I think my idea may be not express correctly. A example as follows:
> 1, mkdir test
> 2, touch test.c
> 3, auditctl -w /home/test -k 11
> 4, auditctl -w /home/test.c -k 11

And then what did you do to create these records?


> My question is why no information will be output by kernel hook funtion?

What is missing? I can't tell what commands you run and what you expected to 
be output by the kernel.


> Correct me if I am wrong, I think when watch a directory, kernel-audit can
> also supply more information by kernel hook funtion

What other information do you need?

Also, note that -w rules are legacy for compatibility with RHEL4 kernel. They 
are used to express simple ideas like watch this file or directory subtree. 
If you want tight control over what you are auditing, you should use the 
syscall audit format where you can express more details about what you wanted 
to trigger on. IOW, you can express that you want changes to a directory 
itself rather than the files in the directory.

-Steve