I'm trying to figure out how to log/track when a user gets a
Permission denied notice after attempting to access a file. I've read that adding a rule to
/etc/audit/audit.rules can accomplish this.
The only suggestion that I've seen mentioned appears to not work as intended. Or, at least, it does not do what I would like. It very well may work the way it is written. The rule is
-a always,exit -F arch=b64 -S open -F success!=0
Actually, the suggestion at the link above does not include the arch option. I had to add that.
/var/log/audit/audit.log I'm seeing everything that says
success=yes. This includes when I click a window and change focus or enter key combinations to change between window functions. What I'm not seeing is anything relating to
Permission denied to include
success=no entries or anything about a specific file that I attempt to open knowing I don't have permissions on it.
All I can say definitively is that when I grep for
/var/log/audit/audit.log nothing is returned.
What should the rule be? Or better yet, is this even actually possible? Is the solution above incorrect?