On Wed, 14 Mar 2018 15:51:44 +0300
Kerem Aksu wrote:
> Hello,
>
> I am trying to trace files by using this rule :
> "-a always,exit -F arch=b64 -S read,write,open,close -k file_op"
>
> I can trace open() system calls with the "type=path" log occurred
> with the same ID as the open() system call. I can learn which file is
> opened by that open() system call.
If open returns a non-negative number, then that is the descriptor.
You'll need to match that descriptor as an argument to the other
syscalls for the same pid. You might need to watch exit_group also since
a program exiting closes all descriptors. And also you'll need to check
flags set by open and fcntl to see if CLOEXEC is being set.
> But when it comes to other system calls I am unable to learn which
> file is read, wrote or closed.
This is implicit by referencing the descriptor.
> I tried to match arguments passed to system calls (a[0..3]) but those
> are different than the arguments defined in linux man pages. I might
> misunderstand these arguments.
No, they are pretty much the same.
> How can I match these or any other (file) system calls with the files
> that they used onto.
> And when does a "type=PATH" log occurs?
You'll probably need to write a program using auparse to save the
descriptor from an open or openat and then output the information you
need as a custom program.
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
