On Tue, 2006-06-20 at 14:32 -0400, Steve wrote: > >> Instead, you audit the file open, and make a note of whether the file > >> was opened read-only, or for read/write. If it was opened for > >> read/write, one presumes that it was written to. > > Is it possible to tell if a file was opened read/write or read-only from > the events generated by audit? > > Thanks, > Steve
Hi Steve, You should be able to ascertain this information from the open() audit record. I thought at one time the flags were recorded in the record, but perhaps no longer (or maybe my memory does not serve me well :)). The record does record syscall arguments, however, so perhaps you could analyze a1= (I believe this is the argument that passes flags), and figure out with what flags open() was called with. Admittedly, I'm not so knowledgeable these days as to what is actually being reported in the audit log. -tim -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
