5

I've been reading some information about configuration of auditd and I just can't figure this out, what I know how to do

  • Log specific system calls by a user
  • Log access to a specific file by all users

What I can't figure out is however: how to set up audit daemon so that it logs access (read/write) to ALL files within a folder structure (for example /home and all subfolders and files within) ONLY for a given user id.

So that if I had a user "bob" with user ID 2053 I would know every file they ever attempted to open or read on filesystem. I am not interested about access to these files by system services or any other user.

Extra question: Is it somehow possible to set up this kind of audit for whole filesystem hierarchy? AFAIK audit doesn't allow that for some reasons

  • Can't you filter report during postprocessing? – Basilevs Mar 1 '15 at 6:39
  • I doubt, using audit on whole FS would probably produce gigabytes of logs per minute... – Petr Mar 1 '15 at 19:17
2
+50

I'd start with something like this:

# auditctl -a exit,always -F arch=x86_64 -S open -F auid=1000 -k track-guido

this will track all file open operations for the user with uid=1000, on all the filesystem; beware that if you run it on an user with a graphical session, this will generate HEAPS of logs, for instance stuff (unwanted, I guess) like:

# ausearch -i -k track-guido
---- (chrome opening /etc/hosts )
type=PROCTITLE msg=audit(03/05/2015 19:49:14.990:257528) : proctitle=/opt/google/chrome/chrome  
type=PATH msg=audit(03/05/2015 19:49:14.990:257528) : item=0 name=/etc/hosts inode=917951 dev=08:02 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:net_conf_t:s0 nametype=NORMAL 
type=CWD msg=audit(03/05/2015 19:49:14.990:257528) :  cwd=/home/guido 
type=SYSCALL msg=audit(03/05/2015 19:49:14.990:257528) : arch=x86_64 syscall=open success=yes exit=164 a0=0x7f843c7682fe a1=O_RDONLY|O_CLOEXEC a2=0x1b6 a3=0x7f84411c070c items=1 ppid=1665 pid=3224 auid=guido uid=guido gid=guido euid=guido suid=guido fsuid=guido egid=guido sgid=guido fsgid=guido tty=(none) ses=1 comm=WorkerPool/3224 exe=/opt/google/chrome/chrome subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=track-guido 
---- (gnome-shell opening /proc/self/stat)
type=PROCTITLE msg=audit(03/05/2015 19:49:15.041:257529) : proctitle=/usr/bin/gnome-shell 
type=PATH msg=audit(03/05/2015 19:49:15.041:257529) : item=0 name=/proc/self/stat inode=21375 dev=00:03 mode=file,444 ouid=guido ogid=guido rdev=00:00 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 nametype=NORMAL 
type=CWD msg=audit(03/05/2015 19:49:15.041:257529) :  cwd=/home/guido 
type=SYSCALL msg=audit(03/05/2015 19:49:15.041:257529) : arch=x86_64 syscall=open success=yes exit=42 a0=0x7f7b7b7a5f4a a1=O_RDONLY a2=0x7fff4ce2aaa0 a3=0x1 items=1 ppid=1371 pid=1665 auid=guido uid=guido gid=guido euid=guido suid=guido fsuid=guido egid=guido sgid=guido fsgid=guido tty=(none) ses=1 comm=gnome-shell exe=/usr/bin/gnome-shell subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=track-guido 

To refine the rule and have such control over a directory tree, this would turn to:

# auditctl -w /home/guido/Development/git/ -F auid=1000 -p rwxa -k track-guido-development

where:

-F auid=     filter on actual uid
-p rwxa      track Read, Write, eXecute, Attributes

(you can combine how many -F you want).

giving output like:

# ausearch -i -k track-guido-development
----
type=PROCTITLE msg=audit(03/05/2015 22:04:40.893:365951) : proctitle=vim /home/guido/Development/git/eduFXserver.git/pom.xml 
type=PATH msg=audit(03/05/2015 22:04:40.893:365951) : item=0 name=/home/guido/Development/git/eduFXserver.git/.pom.xml.swp inode=11146444 dev=08:05 mode=file,600 ouid=guido ogid=guido rdev=00:00 obj=unconfined_u:object_r:user_home_t:s0 nametype=NORMAL 
type=CWD msg=audit(03/05/2015 22:04:40.893:365951) :  cwd=/home/guido 
type=SYSCALL msg=audit(03/05/2015 22:04:40.893:365951) : arch=x86_64 syscall=getxattr success=yes exit=37 a0=0x241e6d0 a1=0x7fc8479afcee a2=0x241e720 a3=0xff items=1 ppid=784 pid=9231 auid=guido uid=guido gid=guido euid=guido suid=guido fsuid=guido egid=guido sgid=guido fsgid=guido tty=pts3 ses=1 comm=vim exe=/usr/bin/vim subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=track-guido-development 
----
type=PROCTITLE msg=audit(03/05/2015 22:04:40.893:365953) : proctitle=vim /home/guido/Development/git/eduFXserver.git/pom.xml 
type=PATH msg=audit(03/05/2015 22:04:40.893:365953) : item=0 name=/home/guido/Development/git/eduFXserver.git/.pom.xml.swp inode=11146444 dev=08:05 mode=file,600 ouid=guido ogid=guido rdev=00:00 obj=unconfined_u:object_r:user_home_t:s0 nametype=NORMAL 
type=CWD msg=audit(03/05/2015 22:04:40.893:365953) :  cwd=/home/guido 
type=SYSCALL msg=audit(03/05/2015 22:04:40.893:365953) : arch=x86_64 syscall=getxattr success=yes exit=37 a0=0x241e6d0 a1=0x7fc8479afcee a2=0x241e720 a3=0xff items=1 ppid=784 pid=9231 auid=guido uid=guido gid=guido euid=guido suid=guido fsuid=guido egid=guido sgid=guido fsgid=guido tty=pts3 ses=1 comm=vim exe=/usr/bin/vim subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=track-guido-development 
----

which still will contain lots of unwanted stuff, but much better. If system becomes unresponsive because one of your rules taking over, you can execute:

# auditctl -R /etc/audit/audit.rules

as a panic mode to reset to default (empty) rules.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.