renameat2 syscall is not recorded

renameat2 syscall is not recorded

[Alan Evangelista]

[-- Attachment #1.1: Type: text/plain, Size: 799 bytes --]

I have the following audit rule:

-a exit,always -F dir=/data -F arch=b64 -S open -S unlink -S unlinkat -S
link -S rename -S renameat S renameat2 -S chmod -S fchmod -S fchmodat -S
chown -S fchown -S fchownat -S mkdir -S rmdir -S setxattr -S lsetxattr -S
fsetxattr -S removexattr -S lremovexattr -S fremovexattr -k filesystem_op

I straced the "mv" command to be sure it's implemented using the renameat2
syscall:

# strace mv /data/test5.txt /data/test6.txt
execve("/bin/mv", ["mv", "/data/test5.txt", "/data/test6.txt"],
0x7ffdf760a210 /* 23 vars */) = 0
(...)
renameat2(AT_FDCWD, "/data/test5.txt", AT_FDCWD, "/data/test6.txt", 0) = 0
(...)

However, I don't see any events recorded in the auditd log file when I move
files using the "mv" command. Am I doing something wrong?


Thanks in advance.

[-- Attachment #1.2: Type: text/html, Size: 1099 bytes --]

[-- Attachment #2: Type: text/plain, Size: 106 bytes --]

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: renameat2 syscall is not recorded

[Paul Moore]

On Tue, Mar 9, 2021 at 1:44 PM Alan Evangelista <alan.vitor@gmail.com> wrote:
>
> I have the following audit rule:
>
> -a exit,always -F dir=/data -F arch=b64 -S open -S unlink -S unlinkat -S link -S rename -S renameat S renameat2 -S chmod -S fchmod -S fchmodat -S chown -S fchown -S fchownat -S mkdir -S rmdir -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -k filesystem_op
>
> I straced the "mv" command to be sure it's implemented using the renameat2 syscall:
>
> # strace mv /data/test5.txt /data/test6.txt
> execve("/bin/mv", ["mv", "/data/test5.txt", "/data/test6.txt"], 0x7ffdf760a210 /* 23 vars */) = 0
> (...)
> renameat2(AT_FDCWD, "/data/test5.txt", AT_FDCWD, "/data/test6.txt", 0) = 0
> (...)
>
> However, I don't see any events recorded in the auditd log file when I move files using the "mv" command. Am I doing something wrong?

This works for me on my test system, a few questions:

* What distro and kernel are you using?

* I'm assuming you see audit records for other SYSCALLS?

* Are you able to share the output of 'auditctl -l'?  If so, please do
if it isn't too long.

--
paul moore
www.paul-moore.com


--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: renameat2 syscall is not recorded

[Ondrej Mosnacek]

On Tue, Mar 9, 2021 at 7:44 PM Alan Evangelista <alan.vitor@gmail.com> wrote:
> I have the following audit rule:
>
> -a exit,always -F dir=/data -F arch=b64 -S open -S unlink -S unlinkat -S link -S rename
> -S renameat S renameat2 -S chmod

Not sure if this is it, but there is a "-" missing before the "S"
before "renameat2".

> -S fchmod -S fchmodat -S chown -S fchown -S fchownat -S mkdir -S rmdir -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -k filesystem_op
>
> I straced the "mv" command to be sure it's implemented using the renameat2 syscall:
>
> # strace mv /data/test5.txt /data/test6.txt
> execve("/bin/mv", ["mv", "/data/test5.txt", "/data/test6.txt"], 0x7ffdf760a210 /* 23 vars */) = 0
> (...)
> renameat2(AT_FDCWD, "/data/test5.txt", AT_FDCWD, "/data/test6.txt", 0) = 0
> (...)
>
> However, I don't see any events recorded in the auditd log file when I move files using the "mv" command. Am I doing something wrong?
>
>
> Thanks in advance.
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://listman.redhat.com/mailman/listinfo/linux-audit

-- 
Ondrej Mosnacek
Software Engineer, Linux Security - SELinux kernel
Red Hat, Inc.

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: renameat2 syscall is not recorded

[Alan Evangelista]

[-- Attachment #1.1: Type: text/plain, Size: 301 bytes --]

OM> Not sure if this is it, but there is a "-" missing before the "S" before
 "renameat2".

This was indeed the issue. I found our that was the issue when I ran
"auditctl -l". Thank you.

Is there any reason why augenrules and auditctl -R don't print errors to
stdout when rules parsing errors occur?

[-- Attachment #1.2: Type: text/html, Size: 728 bytes --]

[-- Attachment #2: Type: text/plain, Size: 106 bytes --]

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: renameat2 syscall is not recorded

[Steve Grubb]

On Wednesday, March 10, 2021 5:53:42 AM EST Alan Evangelista wrote:
> OM> Not sure if this is it, but there is a "-" missing before the "S"
> before "renameat2".
> 
> This was indeed the issue. I found our that was the issue when I ran
> "auditctl -l". Thank you.
> 
> Is there any reason why augenrules

It has no idea about the rules, it simply compiles the master list.

> and auditctl -R don't print errors to stdout when rules parsing errors
> occur?

If it's detected that the rules are in a file, they get sent to syslog because 
99.99% of the time, this is system boot or initscripts and we need to make 
the problem discoverable later by the system admin.

-Steve


--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: renameat2 syscall is not recorded

[Alan Evangelista]

[-- Attachment #1.1: Type: text/plain, Size: 1663 bytes --]

AE>  Is there any reason why (...) auditctl -R don't print errors to stdout
when rules parsing errors occur?

SG> If it's detected that the rules are in a file, they get sent to syslog
because
     > 99.99% of the time, this is system boot or initscripts and we need
to make
     > the problem discoverable later by the system admin.

I assume you meant "if it's detected that there are errors in the rules in
a rules file".
IMHO the stream to which errors are output (syslog or stdout) should be
configurable,
as it is *very* confusing to run auditctl -R manually and get no errors
when there is an
error in rules parsing. It forces the user to always run "auditctl -R" and
"auditctl -l" to check
if the rules are indeed active, which is not intuitive at all. Regarding
the initscript use case,
I think it's also very common to use "auditctl -R" while creating new audit
rules.

On Wed, Mar 10, 2021 at 4:06 PM Steve Grubb <sgrubb@redhat.com> wrote:

> On Wednesday, March 10, 2021 5:53:42 AM EST Alan Evangelista wrote:
> > OM> Not sure if this is it, but there is a "-" missing before the "S"
> > before "renameat2".
> >
> > This was indeed the issue. I found our that was the issue when I ran
> > "auditctl -l". Thank you.
> >
> > Is there any reason why augenrules
>
> It has no idea about the rules, it simply compiles the master list.
>
> > and auditctl -R don't print errors to stdout when rules parsing errors
> > occur?
>
> If it's detected that the rules are in a file, they get sent to syslog
> because
> 99.99% of the time, this is system boot or initscripts and we need to make
> the problem discoverable later by the system admin.
>
> -Steve
>
>
>

[-- Attachment #1.2: Type: text/html, Size: 2327 bytes --]

[-- Attachment #2: Type: text/plain, Size: 106 bytes --]

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit