Why there is no PATH record for change file time syscalls ?(utimensat)

[Steve Grubb]

On Friday, September 8, 2017 4:41:47 AM EDT Richard Guy Briggs wrote:
> On 2017-09-07 18:32, Steve Grubb wrote:
> > On Wednesday, September 6, 2017 6:03:18 AM EDT Lev Olshvang wrote:
> > > I got only following SYSCALL record in audit log for 'touch -t '
> > > command, no CWD, no PATH record
> > 
> > Out of curiosity, what kind of rule were you using?
> > 
> > > type=SYSCALL msg=audit(1503837757.149:266995):
> > > arch=c000003e syscall=280 success=yes exit=0 a0=0 a1=0 a2=7fffbb26bb10
> > > a3=0 items=0 ppid=101 pid=102 auid=1000 uid=0 gid=31 euid=0 suid=0
> > > fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts4 ses=1 comm="touch" 
> > > exe="/bin/touch" key="times"
> > 
> > I think you found a problem. I also think the syscall should be added to:
> > 
> > include/asm-generic/audit_change_attr.h
> 
> Steve, my naive addition of utime, utimes, futimesat and utimensat to
> include/asm-generic/audit_change_attr.h seems to have made no
> difference.

There seems to be 2 problems. 1) the utimensat syscall not getting a path 
record, 2) you can't use the -F perms=a because the syscall tables seem to be 
way out of date. fchmodat seems to be the last syscall added. There's about 70 
new syscalls that need to be looked through and added. This is the easier of 
the 2 problems.

-Steve

> > I think this syscall and others have been added since the watch
> > permissions files were setup.
> > 
> > -Steve
> 
> - RGB
> 
> --
> Richard Guy Briggs <rgb at redhat.com>
> Sr. S/W Engineer, Kernel Security, Base Operating Systems
> Remote, Ottawa, Red Hat Canada
> IRC: rgb, SunRaycer
> Voice: +1.647.777.2635, Internal: (81) 32635