log deletion of directories?

[Steve Grubb]

On Friday 05 September 2008 19:34:24 Brian LaMere wrote:
> Trying to find what is deleting a directory (/tmp/xauth).  Thought I'd
> start with the basics, and just putting a watch on it.
>
> [bel at comsup]:/etc/audit > auditctl -w /testdir/checkdir -p rwxa -k
> missingfiles

This rule translates to:

auditctl -a always,exit -F dir=/testdir/checkdir -F perm=rwxa -k missingfiles

This watches any *files* in the /testdir/checkdir directory and it's 
subdirectories. To check the directory itself, you need to use the "path" 
field to point at the directory and not the files it contains.

[root ~]# mkdir temp
[root ~]# auditctl -a exit,always -F path=/root/temp -F perm=wa -k rm
[root ~]# rmdir temp/
[root ~]# ausearch --start recent -k rm
time->Sat Sep  6 18:30:10 2008
node=127.0.0.1 type=PATH msg=audit(1220740210.750:906): item=1 name="temp/" 
inode=13664599 dev=08:08 mode=040755 ouid=0 ogid=0 rdev=00:00 
obj=unconfined_u:object_r:user_home_t:s0 
node=127.0.0.1 type=PATH msg=audit(1220740210.750:906): item=0  name="/root" 
inode=13664257 dev=08:08 mode=040750 ouid=0 ogid=0 rdev=00:00 
obj=system_u:object_r:user_home_dir_t:s0 
node=127.0.0.1 type=CWD msg=audit(1220740210.750:906):  cwd="/root" 
node=127.0.0.1 type=SYSCALL msg=audit(1220740210.750:906): arch=c000003e 
syscall=84 success=yes exit=0 a0=7fff777e189e a1=2 a2=3960b66114 
a3=3960b67a70 items=2 ppid=3621 pid=3940 auid=4325 uid=0 gid=0 euid=0 suid=0 
fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=2 comm="rmdir" exe="/bin/rmdir" 
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="rm" 


-Steve