From: Amjad Gabbar <amjadgabbar11@gmail.com>
To: linux-audit@redhat.com
Subject: Sycall Rules vs Watch Rules
Date: Wed, 6 Sep 2023 10:56:11 -0500 [thread overview]
Message-ID: <CAJcJf=Qb7muwWG4DyQtEcCKmCOETD4H3h1BoGrewJ5u26r6o=w@mail.gmail.com> (raw)
[-- Attachment #1.1: Type: text/plain, Size: 771 bytes --]
Hi,
I have done some analysis and digging into how both the watch rules and
syscall rules are translated.
From my understanding, in terms of logging, both the below rules are
similar. There is no difference in either of the rules.
1. -w /etc -p wa -k ETC_WATCH
2. -a always,exit -F arch=b64 -S <all syscalls part of the write and attr
classes> -F dir=/etc -F perm=wa -k ETC_WATCH
The write and attr classes consist of syscalls in
“include/asm-generic/audit_*.h“.
The perm flag is needed in the second case for including open/openat
syscalls which are not a part of the write and attr syscall list.
I'd like to verify if what I mentioned earlier is accurate, and I have an
additional point but depends on whether this is accurate.
Ali
[-- Attachment #1.2: Type: text/html, Size: 4064 bytes --]
[-- Attachment #2: Type: text/plain, Size: 107 bytes --]
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
next reply other threads:[~2023-09-06 15:57 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-06 15:56 Amjad Gabbar [this message]
2023-09-06 19:58 ` Sycall Rules vs Watch Rules Richard Guy Briggs
2023-09-12 21:20 ` Amjad Gabbar
2023-09-15 6:00 ` Amjad Gabbar
2023-09-19 23:12 ` Steve Grubb
2023-09-20 0:26 ` Amjad Gabbar
2023-09-20 18:45 ` Steve Grubb
2023-09-20 23:33 ` Steve Grubb
2023-09-21 20:02 ` Amjad Gabbar
2023-09-28 15:53 ` Steve Grubb
2023-09-28 16:30 ` Steve Grubb
2023-09-29 16:39 ` Amjad Gabbar
2023-10-08 4:46 ` Amjad Gabbar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAJcJf=Qb7muwWG4DyQtEcCKmCOETD4H3h1BoGrewJ5u26r6o=w@mail.gmail.com' \
--to=amjadgabbar11@gmail.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).