[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Bypassing audit's file watches

Timothy R. Chavez wrote:
On Fri, 2006-07-07 at 10:58 -0400, Steve wrote:
I have found that I can modify files that are being watched and audit not catch it (ie. no events are dispatched). When monitoring a file for all system calls, I can:

echo "" > /file/to/watch


cat some_file > /file/to/watch

without generating audit events. I assume this has to do with how the kernel handles re-direction. Is it possible to catch these modifications?


What are your rules?  You should catch these on open()
of /file/to/watch, right?


I am seeing this as well with the .42 kernel and audit-1.2.4-1. Not sure when this might have broken, but its broke now.

It seems if you set a watch on /file/to (to use your example above), then you are getting the opens that bash does, although the PATH record shows the item as "/file/to/watch".

So watching the parent directory will audit redirect shell magic, but watching the target of that redirection will not audit that same magic.


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]