When I do:

echo "#TEST" >> /etc/passwd

I get the following in audit logging:

node=kayak.office.local type=SYSCALL msg=audit(1412687666.054:62033):
    arch=c000003e syscall=2 success=yes exit=3 a0=2939480 a1=241 a2=1b6
    a3=76 items=2 ppid=12744 pid=12748 auid=1030 uid=0 gid=0 euid=0 
    suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1769 comm="bash" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="identity"

node=kayak.office.local type=CWD     msg=audit(1412687666.054:62033):  

node=kayak.office.local type=PATH    msg=audit(1412687666.054:62033):
    item=0 name="/etc/" inode=13    dev=fd:00 mode=040755  ouid=0 ogid=0 
    rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT

node=kayak.office.local type=PATH    msg=audit(1412687666.054:62033):  
    item=1 name=(null)  inode=15883 dev=fd:00 mode=0100644 ouid=0 ogid=0 
    rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=NORMAL

(spaces added for readability)

The inode of /etc/passwd is indeed 11908, but this is hard to parse with external tooling, which make rules based on file names. Can I get the file name/path?

  • Try looking at this data using ausearch instead. – slm Oct 7 '14 at 13:57
  • ausearch does not seem to have this info either... – Karlo Oct 7 '14 at 18:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.