How to define rule for SERVICE_START/STOP?
Steve Grubb
sgrubb at redhat.com
Mon Aug 4 20:34:02 UTC 2014
On Monday, August 04, 2014 03:16:18 PM Gisela Cheng wrote:
> We want to use Linux audit type SERVICE_START/STOP for our application
> running as service.
> But I am not able to find example on how to use auditctl to define the
> rule. It seems to me that all the examples are of rules defined for
> system_calls.
There are 2 kinds of events. Some are hardwired into the applications (or
kernel) and they send them if auditing is enabled. The other kind are
discretionary in that the admin defines what to audit. The problem with the
discretionary rules are that it is from the kernel's point of view. Meaning
that you only get events as the process transitions through something the
kernel controls like files or syscalls.
> Questions:
> 1. Can I use audit type SERVICE_START/STOP for my application runs as
> service?
The SERVICE_START/STOP command are intended to be sent by the init daemon.
Systemd already sends these. Upstart could be patched, but if that is done it
would need to match the layout, order, and formatting of the systemd events.
> or would it be considered as type USR_CMD?
USER_CMD is for something like sudo to record what command the user will be
running.
> 2. How do I use auditctl to define rule for SERVICE_START/STOP? Can you
> direct/point me to URL/documentation where it is documented?
It can't define these events because the kernel only sees a process start or
stop. It has no idea that its a service. Only init can tell the difference.
-Steve
More information about the Linux-audit
mailing list