Filter
Top Products
• serial: A unique number that helps identify a particular audit record. Along with ctime, it can
determine which pieces belong to the same audit record. The (timestamp, serial) tuple is unique for
each syscall and it lives from syscall entry to syscall exit.
• ctime: Time at system call entry.
• major: System call number.
• argv array: The first 4 arguments of the system call.
• name_count: Number of names. The maximum defined is 20.
• audit_names: An array of audit_names structure which holds the data copied by
getname().
• auditable: This field is set to 1 if the audit_context needs to be written on syscall exit.
• pwd: Current working directory from where the task has started.
• pwdmnt: Current working directory mount point. pwdmnt and pwd are used to set the cwd field of
FS_WATCH audit record type.
• aux: A pointer to auxiliary data structure to be used for event specific audit information.
• pid: Process id.
• arch: The machine architecture.
• personality: The OS personality number.
• Other fields: The audit context also holds the various user and group real, effective, user and file
system id’s: uid, euid, suid, fsuid, gid, egid, sgid, fsgid.
5.6.1.2 File system audit components
File system auditing is implemented using of the inotify kernel file modification notification system (Section
5.1.4). The kernel audit subsystem initialization routine audit_init() registers a vector of inotify
operations using the inotify_init() function. The operations vector contains the audit subsystem
inotify event notification function audit_handle_ievent() and the audit subsystem inotify destroy
function audit_free_parent(). The audit subsystem inotify handle is returned by a successful
audit_init() call. When audit inotify events occur, the audit_handle_event() updates audit
context inode data to reflect changes in watched file status.
When the audit subsystem receives an instruction from auditctl to set a watch on a file system object, the
audit_recieve_skb() function receives the netlink packet in the kernel. It in turn calls
audit_receive_message(), which dispatches the appropriate function based upon the operation
requested. For audit rule updates, it calls audit_receive_filter(). The
audit_receive_filter() routine calls audit_data_to_entry(), which converts the audit data
to a watch and calls audit_to_watch() to initialize the audit watch data structure, and then calls
audit_add_rule(). The audit add_rule_function() adds the inotify watch for the watch rule by
calling audit_add_watch(), which scans the list of active audit inotify watch parents and adds the parent
if it does not already exist by calling audit_init_parent(). The audit_init_parent() function
calls inotify_init_watch() and inotify_add_watch() to initialize the inotify watch and
register it with the inotify subsystem. It finally adds the watch to the parent by calling the
audit_add_to_parent() function, which associates the watch rule with the watch parent.
135