renameat2 syscall is not recorded

[Ondrej Mosnacek]

On Tue, Mar 9, 2021 at 7:44 PM Alan Evangelista <alan.vitor at gmail.com> wrote:
> I have the following audit rule:
>
> -a exit,always -F dir=/data -F arch=b64 -S open -S unlink -S unlinkat -S link -S rename
> -S renameat S renameat2 -S chmod

Not sure if this is it, but there is a "-" missing before the "S"
before "renameat2".

> -S fchmod -S fchmodat -S chown -S fchown -S fchownat -S mkdir -S rmdir -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -k filesystem_op
>
> I straced the "mv" command to be sure it's implemented using the renameat2 syscall:
>
> # strace mv /data/test5.txt /data/test6.txt
> execve("/bin/mv", ["mv", "/data/test5.txt", "/data/test6.txt"], 0x7ffdf760a210 /* 23 vars */) = 0
> (...)
> renameat2(AT_FDCWD, "/data/test5.txt", AT_FDCWD, "/data/test6.txt", 0) = 0
> (...)
>
> However, I don't see any events recorded in the auditd log file when I move files using the "mv" command. Am I doing something wrong?
>
>
> Thanks in advance.
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://listman.redhat.com/mailman/listinfo/linux-audit

-- 
Ondrej Mosnacek
Software Engineer, Linux Security - SELinux kernel
Red Hat, Inc.