Audit record created by echo "ThisIsATest" >>/tmp/test/file11

[Steve Grubb]

On Friday, October 09, 2015 02:43:59 PM Boyd Memmott wrote:
> I have an audit question concerning echo "ThisIsATest" >>/tmp/test/file11
> 
> I have a rule: -w /tmp/test -p war -S all -k thekey
> 
> It produces the following audit record.
> type=SYSCALL msg=audit(1444398577.247:1581): arch=c000003e syscall=2
> success=yes exit=3 a0=1f5bca0 a1=441 a2=1b6 a3=20 items=2 ppid=17766
> pid=17808 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
> tty=pts3 ses=1 comm="bash" exe="/bin/bash" key="thekey" type=CWD
> msg=audit(1444398577.247:1581):  cwd="/tmp/test"
> type=PATH msg=audit(1444398577.247:1581): item=0 name="/tmp/test" inode=1436
> dev=00:2e mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT type=PATH
> msg=audit(1444398577.247:1581): item=1 name="file11" inode=6797 dev=00:2e
> mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=CREATE
> 
> I understand bash is the executable, because ">" is writing to the file via
> a file handle.
> 
> Is there another switch or rule that would improve the audit record to
> capture echo as being the initiator of the command??

In this particular example, keystroke logging would. But in general, the 
answer is no. The reason being that echo is built-in to the shell while 
/bin/echo is an actual program.

For reference, this is what happens when you type a command:

* Bash checks if internal command and handles it
* If its a subshell,
  – forks and starts reading lines and performing them
* Else it: forks, sets up pipes, calls execve(filename, argv, envp)
* Kernel has a list of supported formats
  –ia_32aout
  -Flat
  -Aout
  -Script
  -Em86
  -Elf
  -elf_fdpic
* It iterates through each handler until one accepts the file
* Otherwise bash reports not an executable

-Steve