On Wed, 14 Mar 2018 15:51:44 +0300 Kerem Aksu <ahmtkrm...@gmail.com> wrote:
> Hello, > > I am trying to trace files by using this rule : > "-a always,exit -F arch=b64 -S read,write,open,close -k file_op" > > I can trace open() system calls with the "type=path" log occurred > with the same ID as the open() system call. I can learn which file is > opened by that open() system call. If open returns a non-negative number, then that is the descriptor. You'll need to match that descriptor as an argument to the other syscalls for the same pid. You might need to watch exit_group also since a program exiting closes all descriptors. And also you'll need to check flags set by open and fcntl to see if CLOEXEC is being set. > But when it comes to other system calls I am unable to learn which > file is read, wrote or closed. This is implicit by referencing the descriptor. > I tried to match arguments passed to system calls (a[0..3]) but those > are different than the arguments defined in linux man pages. I might > misunderstand these arguments. No, they are pretty much the same. > How can I match these or any other (file) system calls with the files > that they used onto. > And when does a "type=PATH" log occurs? You'll probably need to write a program using auparse to save the descriptor from an open or openat and then output the information you need as a custom program. -Steve -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit