[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Bypassing audit's file watches



I have found that I can modify files that are being watched and audit not catch it (ie. no events are dispatched). When monitoring a file for all system calls, I can:

echo "" > /file/to/watch

or

cat some_file > /file/to/watch

without generating audit events. I assume this has to do with how the kernel handles re-direction. Is it possible to catch these modifications?

Thanks,
Steve


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]