On Tue, Mar 9, 2021 at 1:44 PM Alan Evangelista <[email protected]> wrote: > > I have the following audit rule: > > -a exit,always -F dir=/data -F arch=b64 -S open -S unlink -S unlinkat -S link > -S rename -S renameat S renameat2 -S chmod -S fchmod -S fchmodat -S chown -S > fchown -S fchownat -S mkdir -S rmdir -S setxattr -S lsetxattr -S fsetxattr -S > removexattr -S lremovexattr -S fremovexattr -k filesystem_op > > I straced the "mv" command to be sure it's implemented using the renameat2 > syscall: > > # strace mv /data/test5.txt /data/test6.txt > execve("/bin/mv", ["mv", "/data/test5.txt", "/data/test6.txt"], > 0x7ffdf760a210 /* 23 vars */) = 0 > (...) > renameat2(AT_FDCWD, "/data/test5.txt", AT_FDCWD, "/data/test6.txt", 0) = 0 > (...) > > However, I don't see any events recorded in the auditd log file when I move > files using the "mv" command. Am I doing something wrong?
This works for me on my test system, a few questions: * What distro and kernel are you using? * I'm assuming you see audit records for other SYSCALLS? * Are you able to share the output of 'auditctl -l'? If so, please do if it isn't too long. -- paul moore www.paul-moore.com -- Linux-audit mailing list [email protected] https://listman.redhat.com/mailman/listinfo/linux-audit
