From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: Auditing the "chattr" command (ioctl syscall?)
Date: Wed, 24 Aug 2011 10:40:32 -0400 [thread overview]
Message-ID: <201108241040.32951.sgrubb@redhat.com> (raw)
In-Reply-To: <D0A5F96279337C499E18E7D5B0695A2F67DD6395@HAMMBX02.uk.betfair.local>
On Wednesday, August 24, 2011 09:57:13 AM Max Williams wrote:
> Hi,
> I would like to be able to audit the syscalls that the chattr command uses
> but I'm not having much luck. In an effort to see the syscalls used, I
> created a rule to log all syscalls, like this: # auditctl -a exit,always
> -F path=/root/file
>
> Then run this:
> # chattr +i /root/file
>
> This produces series of two syscalls in the logs, 6 (sys_newlstat) and 2
> (sys_open): node=localhost.localdomain type=SYSCALL
> msg=audit(1314189320.335:53158): arch=c000003e syscall=6 success=yes
> exit=0 a0=7ffff0f8886c a1=7ffff0f88250 a2=7ffff0f88250 a3=1 items=1
> ppid=15560 pid=15745 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=pts0 ses=1198 comm="chattr" exe="/usr/bin/chattr"
> key=(null) node=localhost.localdomain type=SYSCALL
> msg=audit(1314189320.335:53160): arch=c000003e syscall=2 success=yes
> exit=3 a0=7ffff0f8886c a1=800 a2=7ffff0f88170 a3=1 items=1 ppid=15560
> pid=15745 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
> tty=pts0 ses=1198 comm="chattr" exe="/usr/bin/chattr" key=(null)
>
> I don't think these are the syscalls I want to audit,
nope. You can use the autrace program also and get a strace like list of syscalls made
by the process.
> they would be far too
> frequent. I also noticed when I run a strace on the chattr command it
> looks like it uses ioctl, eg: ioctl(3, EXT2_IOC_SETFLAGS, 0x7fff0314cf3c)
>
> What audit rule could I use to achieve this?
It starts off like this:
-a always,exit -F arch=b64 -S ioctl
Then you need to look at the man page for ioctl. The first argument is the FD, so you
will not have a a0 since that could be different from program to program. Then you
need to look in the header files for the definition of EXT2_IOC_SETFLAGS.
/usr/include/linux/ext2_fs.h
#define EXT2_IOC_SETFLAGS FS_IOC_SETFLAGS
/usr/include/linux/fs.h
#define FS_IOC_SETFLAGS _IOW('f', 2, long)
/usr/include/asm-generic/ioctl.h
#define _IOW(type,nr,size) _IOC(_IOC_WRITE,(type),(nr),(_IOC_TYPECHECK(size)))
#define _IOC(dir,type,nr,size) \
(((dir) << _IOC_DIRSHIFT) | \
((type) << _IOC_TYPESHIFT) | \
((nr) << _IOC_NRSHIFT) | \
((size) << _IOC_SIZESHIFT))
# define _IOC_WRITE 1U
Looks hard to figure out? Let's make a program:
#include <stdio.h>
#include <linux/fs.h>
#include <linux/ext2_fs.h>
int main(void)
{
printf("%0lX\n", EXT2_IOC_SETFLAGS);
return 0;
}
It returns this: 40086602
So, the rule is:
-a always,exit -F arch=b64 -S ioctl -F a1=40086602
I don't know if the syscall requires more arguments. You would have to look at the
chattr program for more. Also note that you might want a matching b32 rule also. If
you wanted to limit this to a file, then put a -F path= on that also. Adding a key field
helps in searching later.
-Steve
next prev parent reply other threads:[~2011-08-24 14:40 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-08-24 13:57 Auditing the "chattr" command (ioctl syscall?) Max Williams
2011-08-24 14:40 ` Steve Grubb [this message]
2011-08-24 15:31 ` Max Williams
2011-08-24 15:50 ` Steve Grubb
2011-08-24 15:53 ` Steve Grubb
2011-08-24 16:04 ` Max Williams
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=201108241040.32951.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.