1

I am running a (complex) script that seems to modify at some point a file. I would like to get warnings whenever the script / program tries to write, chmod, chown or perform any other attempt that I disapprove of. I want the program to have normal access to the rest of the filesystem.

Denying access is one solution, but since I have to run the script as root, it won't work. The script could override any access control settings. Even if I could run the script as non-root, the script could decide to take a different branch on access failure. That's why I prefer a warning-on-access instead of an access denial. Is there a solution (e.g. SE Linux)?

Improve this question

4 Answers 4

Reset to default
2

There are a few ways of doing this:

auditd

use the following command to enable auditd monitoring of the file (after making sure the auditd service is running):

auditctl -a exit,always -F path=/path/to/file

Then look in /var/log/audit/audit.log to see what's going on.

Use the following to remove the rule when done:

auditctl -d exit,always -F path=/path/to/file

fanotify

fanotify is a system designed for things like virus scanners. It allows a program to receive an event notification when another program opens any file. The monitor program can then perform actions like denying access to the file, or merely logging it. The advantage here is that the monitoring program can simply sit on the event and do nothing, so the program which is trying to open the file just delays. It won't get a failure or a success until the monitor program allows it to continue.

The problem with this route though is that fanotify is new, and there aren't any simple command line utilities that you can use to access it. You would have to write your own script (if any scripting libraries have an interface) or program.

Improve this answer
3
  • fanotify with its "sit on the event" feature sounds like what I want. I will investigate
    – dan3
    Oct 23, 2013 at 13:46
  • Spoke too soon. fanotify doesn't notice if you edit /tmp/the-file, then mv /tmp/the-file /path/to/the-file. Which is what editors do. github.com/howeyc/fsnotify/issues/15. I don't if there's any solution.
    – dan3
    Oct 23, 2013 at 14:26
  • That would be a directory operation, because you're not modifying the file, you're modifying the directory the file is in. In fanotify you'd just use FAN_ONDIR to watch the directory instead.
    – phemmer
    Oct 23, 2013 at 17:10
2

If on Linux, chattr +i the-file will prevent any modification operation on the file even to root (except another chattr).

Improve this answer
1
  • Works at preventing access, but script seems to take a decision based on failure and carry on. I still can't tell which part of the script tries to write the file.
    – dan3
    Oct 23, 2013 at 14:27
2

If your system supports dtrace (Solaris and derivatives, FreeBSD, Oracle Linux, Mac OS X), a dtrace script can log and even prevent the mentioned actions to the files you want by whatever user including root.

Dtrace can also be used to freeze the guilty process and let you make the decision to resume or kill it.

Improve this answer
1

For small scripting jobs where fine grained fs access is needed, but one would prefer to avoid dealing with complicated auditing tools gentoo's "sandbox" utility is exceptionally handy. In particular, it provides an easy way to enable and disable write access to selected files interactively (for test then deploy scenarios).

On Gentoo it's available by default, but should not be too difficult to install on other distros.

http://git.overlays.gentoo.org/gitweb/?p=proj/sandbox.git;a=summary

Internally it is implemented on top of the LD_PRELOAD mechanism pulling in an "libsandbox.so" library, which intercepts and filters filesystem calls. It also comes with neat interactive shell wrapper, so one only needs to type "sandbox" to drop into protected shell.

The functionality especially asked for by OP (fake writes) is supported: http://devmanual.gentoo.org/function-reference/sandbox-functions/index.html

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.