RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 908867 - directory watching doesn't work for open/openat/creat
Summary: directory watching doesn't work for open/openat/creat
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.0
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: beta
: 7.0
Assignee: Miroslav Grepl
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks: RHEL7CCC
TreeView+ depends on / blocked
 
Reported: 2013-02-07 17:25 UTC by Jiri Jaburek
Modified: 2013-02-08 09:46 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-02-07 18:04:32 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Jiri Jaburek 2013-02-07 17:25:30 UTC 
Description of problem:
Previously, it was possible to create audit records for events related to a directory using path=/that/dir, ie. something like this worked before, but doesn't work now:

# cd /
# mkdir abc
# auditctl -a exit,always -F arch=b64 -S open -F path=/abc
# since=$(date +%H:%M:%S)
# echo testme > /abc/foo
# auditctl -d exit,always -F arch=b64 -S open -F path=/abc
# ausearch -ts $since

selinux-policy-3.11.1-51.el7.noarch:
----
time->Thu Feb  7 17:48:40 2013
type=PATH msg=audit(1360255720.628:64): item=1 name="/abc/foo" inode=138810 dev=fd:00 mode=0100640 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:default_t:s0
type=PATH msg=audit(1360255720.628:64): item=0 name="/abc/" inode=138635 dev=fd:00 mode=040750 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:default_t:s0
type=CWD msg=audit(1360255720.628:64):  cwd="/"
type=SYSCALL msg=audit(1360255720.628:64): arch=c000003e syscall=2 success=yes exit=3 a0=1dc8c40 a1=241 a2=1b6 a3=9 items=2 ppid=1554 pid=1558 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=2 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
----

selinux-policy-3.11.1-75.el7.noarch:
----
time->Thu Feb  7 17:43:22 2013
type=PATH msg=audit(1360255402.886:12574): item=2 name=(null) inode=264599 dev=fd:00 mode=0100640 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:default_t:s0
type=PATH msg=audit(1360255402.886:12574): item=1 name=(null) inode=264598 dev=fd:00 mode=040750 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:default_t:s0
type=PATH msg=audit(1360255402.886:12574): item=0 name="/abc/foo" inode=264598 dev=fd:00 mode=040750 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:default_t:s0
type=CWD msg=audit(1360255402.886:12574):  cwd="/"
type=SYSCALL msg=audit(1360255402.886:12574): arch=c000003e syscall=2 success=yes exit=3 a0=163f610 a1=241 a2=1b6 a3=9 items=3 ppid=1603 pid=1607 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=2 tty=pts2 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
---

Instead of directory path, we get name=(null).

Note that at least open, openat and creat syscalls are affected, but some others seem to work just fine:

# since=$(date +%H:%M:%S)
# auditctl -a exit,always -F arch=b64 -S linkat -F path=/abc
# ln /etc/passwd /abc/test
# auditctl -d exit,always -F arch=b64 -S linkat -F path=/abc
# ausearch -ts $since
----
time->Thu Feb  7 18:01:21 2013
type=PATH msg=audit(1360256481.514:1494): item=2 name="/abc/test" inode=23553 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:passwd_file_t:s0
type=PATH msg=audit(1360256481.514:1494): item=1 name="/abc/" inode=264598 dev=fd:00 mode=040750 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:default_t:s0
type=PATH msg=audit(1360256481.514:1494): item=0 name="/etc/passwd" inode=23553 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:passwd_file_t:s0
type=CWD msg=audit(1360256481.514:1494):  cwd="/"
type=SYSCALL msg=audit(1360256481.514:1494): arch=c000003e syscall=265 success=yes exit=0 a0=ffffffffffffff9c a1=7fff8db30679 a2=ffffffffffffff9c a3=7fff8db30685 items=3 ppid=1614 pid=4850 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=2 tty=pts1 comm="ln" exe="/usr/bin/ln" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
----


Version-Release number of selected component (if applicable):
selinux-policy-3.11.1-75.el7.noarch
(as a regression against selinux-policy-3.11.1-51.el7.noarch)


How reproducible:
always


Additional info:
Since we need this to be fixed for Common Criteria testing, I'm adding TestBlocker keyword and blocking a RHEL7CCC tracking bug.
Comment 1 Jiri Jaburek 2013-02-07 18:04:32 UTC 
Testing everything again on a clean image (with just selinux-policy-* and audit-* downgraded) has shown that this is not related to selinux-policy or audit, at least not directly. Will try to investigate further.

Sorry for the false alarm.
Comment 2 Steve Grubb 2013-02-07 21:03:23 UTC 
Maybe you needed to use -F dir=/path/to/dir  this is recursive to the bottom of the directory tree (assuming no intervening mount points in which case you also need to use the -q option, too).
Note You need to log in before you can comment on or make changes to this bug.