Fwd: Possible regression

[4javier]

---------- Forwarded message ----------
From: 4javier <4javiereg4 at gmail.com>
Date: 2011/6/2
Subject: Re: Possible regression
To: Steve Grubb <sgrubb at redhat.com>


you're right...sorry for my fault...
I didn't use the -a switch. I read the man, but I cannot understand how this
settings is able to fix the problem with O_CREAT.
Could you explain that to me, please?


2011/6/2 Steve Grubb <sgrubb at redhat.com>

> On Thursday, June 02, 2011 08:48:30 AM 4javier wrote:
> > I'm noticing exactly the same problem mentioned into this old message
> > http://osdir.com/ml/linux.redhat.security.audit/2006-07/msg00036.html
> > Workaround consisting into watching the whole directory containing the
> file
> > works too. I've found that into 2006 a patch was submitted to solve the
> > issue
> > http://www.mail-archive.com/linux-audit@redhat.com/msg00476.html
> >
> > Is this a recent regression, or is there something I don't know?
>
> I just ran the test from that email and got the following:
>
> [root at localhost ~]# touch /tmp/test
> [root at localhost ~]# auditctl -a always,exit -F path=/tmp/test -F perm=rwa
> -k watch
> [root at localhost ~]#  echo "" > /tmp/test
> [root at localhost ~]# cat /tmp/test
>
> [root at localhost ~]# ausearch --start recent --key watch -i
> ----
> type=CONFIG_CHANGE msg=audit(06/02/2011 09:15:49.790:124) : auid=sgrubb
> ses=2
> subj=unconfined_u:unconfined_r:auditctl_t:s0-s0:c0.c1023 op="add rule"
> key=watch
> list=exit res=1
> ----
> type=PATH msg=audit(06/02/2011 09:15:56.970:125) : item=0 name=/tmp/test
> inode=164740
> dev=fd:01 mode=file,644 ouid=root ogid=root rdev=00:00
> obj=unconfined_u:object_r:user_tmp_t:s0
> type=CWD msg=audit(06/02/2011 09:15:56.970:125) :  cwd=/root
> type=SYSCALL msg=audit(06/02/2011 09:15:56.970:125) : arch=x86_64
> syscall=open
> success=yes exit=3 a0=28cadd0 a1=241 a2=1b6 a3=0 items=1 ppid=1634 pid=1640
> auid=sgrubb uid=root gid=root euid=root suid=root fsuid=root egid=root
> sgid=root
> fsgid=root tty=pts1 ses=2 comm=bash exe=/bin/bash
> subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=watch
> ----
> type=PATH msg=audit(06/02/2011 09:16:08.850:126) : item=0 name=/tmp/test
> inode=164740
> dev=fd:01 mode=file,644 ouid=root ogid=root rdev=00:00
> obj=unconfined_u:object_r:user_tmp_t:s0
> type=CWD msg=audit(06/02/2011 09:16:08.850:126) :  cwd=/root
> type=SYSCALL msg=audit(06/02/2011 09:16:08.850:126) : arch=x86_64
> syscall=open
> success=yes exit=3 a0=7fffd7a8f943 a1=0 a2=0 a3=32d80819d0 items=1
> ppid=1640 pid=1659
> auid=sgrubb uid=root gid=root euid=root suid=root fsuid=root egid=root
> sgid=root
> fsgid=root tty=pts1 ses=2 comm=cat exe=/bin/cat
> subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=watch
> [root at localhost ~]# uname -r
> 2.6.38.6-26.rc1.fc15.x86_64
>
> We have 2 events. Are you getting this? Is something missing?
>
> -Steve
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20110602/3e383678/attachment.htm>