[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Bypassing audit's file watches



Amy Griffis wrote:
Steve wrote:  [Fri Jul 07 2006, 10:58:42AM EDT]
I have found that I can modify files that are being watched and audit not catch it (ie. no events are dispatched). When monitoring a file for all system calls, I can:

echo "" > /file/to/watch

or

cat some_file > /file/to/watch

without generating audit events.
>
Are you seeing the open and not the write, or no records at all?
If you are missing events for open() calls, please let us know since
that would be a bug (versus a lacking feature).

I am not seeing the open() or any other syscall records.

Steve


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]