From mboxrd@z Thu Jan 1 00:00:00 1970 From: Max Williams Subject: RE: Auditing the "chattr" command (ioctl syscall?) Date: Wed, 24 Aug 2011 16:04:39 +0000 Message-ID: References: <201108241040.32951.sgrubb@redhat.com> <201108241153.15707.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx11.extmail.prod.ext.phx2.redhat.com [10.5.110.16]) by int-mx12.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id p7OG7qC1003306 for ; Wed, 24 Aug 2011 12:07:52 -0400 Received: from mail1.bemta5.messagelabs.com (mail1.bemta5.messagelabs.com [195.245.231.130]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p7OG7m2n029042 for ; Wed, 24 Aug 2011 12:07:49 -0400 In-Reply-To: <201108241153.15707.sgrubb@redhat.com> Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com Ah, the 0x was it! It was producing the wrong rule: Wrong: LIST_RULES: exit,always arch=3221225534 (0xc000003e) a1=40086602 (0x263ac4a) key=chattr1 syscall=ioctl Right: LIST_RULES: exit,always arch=3221225534 (0xc000003e) a1=1074292226 (0x40086602) key=chattr3 syscall=ioctl You are right, if I specify a path for this rule, it stops working. Thank you very much for your help Steve. Cheers, Max -----Original Message----- From: linux-audit-bounces@redhat.com [mailto:linux-audit-bounces@redhat.com] On Behalf Of Steve Grubb Sent: 24 August 2011 16:53 To: linux-audit@redhat.com Subject: Re: Auditing the "chattr" command (ioctl syscall?) On Wednesday, August 24, 2011 10:40:32 AM Steve Grubb wrote: > So, the rule is: > > -a always,exit -F arch=b64 -S ioctl -F a1=40086602 One correction, you need a 0x in that: -a always,exit -F arch=b64 -S ioctl -F a1=0x40086602 -Steve -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________