I'm trying to figure out how to log/track when a user gets a Permission denied
notice after attempting to access a file. I've read that adding a rule to /etc/audit/audit.rules
can accomplish this.
The only suggestion that I've seen mentioned appears to not work as intended. Or, at least, it does not do what I would like. It very well may work the way it is written. The rule is
-a always,exit -F arch=b64 -S open -F success!=0
Actually, the suggestion at the link above does not include the arch option. I had to add that.
When tailing /var/log/audit/audit.log
I'm seeing everything that says success=yes
. This includes when I click a window and change focus or enter key combinations to change between window functions. What I'm not seeing is anything relating to Permission denied
to include success=no
entries or anything about a specific file that I attempt to open knowing I don't have permissions on it.
All I can say definitively is that when I grep for success=no
in /var/log/audit/audit.log
nothing is returned.
What should the rule be? Or better yet, is this even actually possible? Is the solution above incorrect?