Sycall Rules vs Watch Rules

--===============5015541930894123518==
Content-Type: multipart/alternative; boundary="000000000000f674570604b2c895"

--000000000000f674570604b2c895
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

I have done some analysis and digging into how both the watch rules and
syscall rules are translated.

From my understanding, in terms of logging, both the below rules are
similar. There is no difference in either of the rules.

1. -w /etc -p wa -k ETC_WATCH

2. -a always,exit -F arch=3Db64 -S <all syscalls part of the write and attr
classes> -F dir=3D/etc  -F perm=3Dwa -k ETC_WATCH

The write and attr classes consist of syscalls in
=E2=80=9Cinclude/asm-generic/audit_*.h=E2=80=9C.

 The perm flag is needed in the second case for including open/openat
syscalls which are not a part of the write and attr syscall list.

I'd like to verify if what I mentioned earlier is accurate, and I have an
additional point but depends on whether this is accurate.

Ali

--000000000000f674570604b2c895
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">Hi,<div dir=3D"auto"><br></div><div dir=3D"auto">I have d=
one some analysis and digging into how both the watch rules and syscall rul=
es are translated.</div><div dir=3D"auto"><br></div><div dir=3D"auto">From =
my understanding, in terms of logging, both the below rules are similar. Th=
ere is no difference in either of the rules.</div><div dir=3D"auto"><br></d=
iv><div dir=3D"auto">1. -w /etc -p wa -k ETC_WATCH</div><div dir=3D"auto"><=
br></div><div dir=3D"auto"><div dir=3D"auto"><span style=3D"font-family:-ap=
ple-system,&quot;Helvetica Neue&quot;;font-size:16px;font-style:normal;font=
-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start=
;text-indent:0px;text-transform:none;white-space:normal;word-spacing:1px;te=
xt-decoration:none;float:none;display:inline!important;color:rgb(49,49,49)"=
>2. -a always,exit -F arch=3Db64 -S &lt;all syscalls part of the write and =
attr classes&gt; -F dir=3D/etc =C2=A0-F perm=3Dwa -k ETC_WATCH</span></div>=
<div dir=3D"auto"><span style=3D"font-family:-apple-system,&quot;Helvetica =
Neue&quot;;font-size:16px;font-style:normal;font-variant-caps:normal;font-w=
eight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-trans=
form:none;white-space:normal;word-spacing:1px;text-decoration:none;float:no=
ne;display:inline!important;color:rgb(49,49,49)"><br></span></div><div dir=
=3D"auto"><span style=3D"font-family:-apple-system,&quot;Helvetica Neue&quo=
t;;font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:40=
0;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:non=
e;white-space:normal;word-spacing:1px;text-decoration:none;float:none;displ=
ay:inline!important;color:rgb(49,49,49)">The write and attr classes consist=
 of syscalls in=C2=A0<div dir=3D"auto" style=3D"font-family:-apple-system,&=
quot;Helvetica Neue&quot;"><span style=3D"font-family:-apple-system,&quot;H=
elvetica Neue&quot;;font-size:16px;font-style:normal;font-variant-caps:norm=
al;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;t=
ext-transform:none;white-space:normal;word-spacing:1px;text-decoration:none=
;float:none;display:inline!important;color:rgb(49,49,49)">=E2=80=9Cinclude/=
asm-generic/audit_*.h=E2=80=9C.</span></div><div dir=3D"auto" style=3D"font=
-family:-apple-system,&quot;Helvetica Neue&quot;"><span style=3D"font-famil=
y:-apple-system,&quot;Helvetica Neue&quot;;font-size:16px;font-style:normal=
;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:=
start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:1=
px;text-decoration:none;float:none;display:inline!important;color:rgb(49,49=
,49)"><br></span></div><div dir=3D"auto" style=3D"font-family:-apple-system=
,&quot;Helvetica Neue&quot;"><span style=3D"font-family:-apple-system,&quot=
;Helvetica Neue&quot;;font-size:16px;font-style:normal;font-variant-caps:no=
rmal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px=
;text-transform:none;white-space:normal;word-spacing:1px;text-decoration:no=
ne;float:none;display:inline!important;color:rgb(49,49,49)">=C2=A0The perm =
flag is needed in the second case for including open/openat syscalls which =
are not a part of the write and attr syscall list.</span></div><div dir=3D"=
auto" style=3D"font-family:-apple-system,&quot;Helvetica Neue&quot;"><span =
style=3D"font-family:-apple-system,&quot;Helvetica Neue&quot;;font-size:16p=
x;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing=
:normal;text-align:start;text-indent:0px;text-transform:none;white-space:no=
rmal;word-spacing:1px;text-decoration:none;float:none;display:inline!import=
ant;color:rgb(49,49,49)"><br></span></div><div dir=3D"auto" style=3D"font-f=
amily:-apple-system,&quot;Helvetica Neue&quot;"><div style=3D"font-family:-=
apple-system,&quot;Helvetica Neue&quot;" dir=3D"auto">I&#39;d like to verif=
y if what I mentioned earlier is accurate, and I have an additional point b=
ut depends on whether this is accurate.</div><div style=3D"font-family:-app=
le-system,&quot;Helvetica Neue&quot;" dir=3D"auto"><br></div><div style=3D"=
font-family:-apple-system,&quot;Helvetica Neue&quot;" dir=3D"auto">Ali</div=
><br></div></span></div></div>
</div>

--000000000000f674570604b2c895--

--===============5015541930894123518==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
Linux-audit mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/linux-audit

--===============5015541930894123518==--