Hide Forgot
Description of problem: -a exit,always -F dir=/etc/ -F perm=wa -F key=etc_change This rule has no effect on my system. I can add or change files or directories and do not see any logs in /var/log/audit/audit.log. "aureport -k" shows no new line for key "etc_change". Version-Release number of selected component (if applicable): 2.6.7 How reproducible: Edit a file in /etc and check for new entries in audit.log. Steps to Reproduce: 1. 2. 3. Actual results: no lines Expected results: Changing files in /etc should bring some output in audit.log Here the documentation: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Defining_Audit_Rules_and_Controls.html I also tested the example from this docu: auditctl -w /etc/selinux/ -p wa -k selinux_changes and it did not work. Additional info: -a exit,always -F path=/etc/bla -F perm=wa -F key=test_change This example (monitoring a simple file) is working. Whenever I edit the file /etc/bla I find two new lines in audit.log. When I create or remove it I have one new line.
Here's what I did to check: auditctl -a exit,always -F dir=/etc -F perm=wa -F key=dir-test vi /etc/ssh/sshd_config deleted a comment and saved ausearch --start recent -k dir --raw | aureport --file --summary File Summary Report =========================== total file =========================== 13 /etc/ssh/ 5 /etc/ssh/.sshd_config.swp 5 /etc/ssh/sshd_config 2 /etc/ssh/.sshd_config.swpx 2 /etc/ssh/4913 2 /etc/ssh/sshd_config~ 1 (null) It seems to be working. I also did the following: # touch /etc/test # ausearch --start recent -k dir --raw | aureport --file --summary File Summary Report =========================== total file =========================== 1 /etc/ 1 /etc/test # uname -r 4.8.7-200.fc24.x86_64 Try to delete all your rules and then manually enter just the one rule and retest. I suspect its something in the other rules blocking it.
Ok - I think I got it. I always had this rule active: # This suppresses syscall auditing for all tasks started # with this rule in effect. Remove it if you need syscall # auditing. -a task,never After the removal of this rule it is working. Only thing I don't understand is why it works for single file even with the above rule active.
I suspect it has to do with some tasks have an audit flag in the task struct and some don't. Everything run before auditd starts does not get the flag and cannot be audited. The solution is to add audit=1 to the kernel boot prompt. I'm going to close he bz as there is nothing actionable on my end.