Linux – How to audit access to any file or folder within a given path for specific user

auditlinux

I've been reading some information about configuration of auditd and I just can't figure this out, what I know how to do

  • Log specific system calls by a user
  • Log access to a specific file by all users

What I can't figure out is however: how to set up audit daemon so that it logs access (read/write) to ALL files within a folder structure (for example /home and all subfolders and files within) ONLY for a given user id.

So that if I had a user "bob" with user ID 2053 I would know every file they ever attempted to open or read on filesystem. I am not interested about access to these files by system services or any other user.

Extra question: Is it somehow possible to set up this kind of audit for whole filesystem hierarchy? AFAIK audit doesn't allow that for some reasons

Best Answer

I'd start with something like this:

# auditctl -a exit,always -F arch=x86_64 -S open -F auid=1000 -k track-guido

this will track all file open operations for the user with uid=1000, on all the filesystem; beware that if you run it on an user with a graphical session, this will generate HEAPS of logs, for instance stuff (unwanted, I guess) like:

# ausearch -i -k track-guido
---- (chrome opening /etc/hosts )
type=PROCTITLE msg=audit(03/05/2015 19:49:14.990:257528) : proctitle=/opt/google/chrome/chrome  
type=PATH msg=audit(03/05/2015 19:49:14.990:257528) : item=0 name=/etc/hosts inode=917951 dev=08:02 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:net_conf_t:s0 nametype=NORMAL 
type=CWD msg=audit(03/05/2015 19:49:14.990:257528) :  cwd=/home/guido 
type=SYSCALL msg=audit(03/05/2015 19:49:14.990:257528) : arch=x86_64 syscall=open success=yes exit=164 a0=0x7f843c7682fe a1=O_RDONLY|O_CLOEXEC a2=0x1b6 a3=0x7f84411c070c items=1 ppid=1665 pid=3224 auid=guido uid=guido gid=guido euid=guido suid=guido fsuid=guido egid=guido sgid=guido fsgid=guido tty=(none) ses=1 comm=WorkerPool/3224 exe=/opt/google/chrome/chrome subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=track-guido 
---- (gnome-shell opening /proc/self/stat)
type=PROCTITLE msg=audit(03/05/2015 19:49:15.041:257529) : proctitle=/usr/bin/gnome-shell 
type=PATH msg=audit(03/05/2015 19:49:15.041:257529) : item=0 name=/proc/self/stat inode=21375 dev=00:03 mode=file,444 ouid=guido ogid=guido rdev=00:00 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 nametype=NORMAL 
type=CWD msg=audit(03/05/2015 19:49:15.041:257529) :  cwd=/home/guido 
type=SYSCALL msg=audit(03/05/2015 19:49:15.041:257529) : arch=x86_64 syscall=open success=yes exit=42 a0=0x7f7b7b7a5f4a a1=O_RDONLY a2=0x7fff4ce2aaa0 a3=0x1 items=1 ppid=1371 pid=1665 auid=guido uid=guido gid=guido euid=guido suid=guido fsuid=guido egid=guido sgid=guido fsgid=guido tty=(none) ses=1 comm=gnome-shell exe=/usr/bin/gnome-shell subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=track-guido

To refine the rule and have such control over a directory tree, this would turn to:

# auditctl -w /home/guido/Development/git/ -F auid=1000 -p rwxa -k track-guido-development

where:

-F auid=     filter on actual uid
-p rwxa      track Read, Write, eXecute, Attributes

(you can combine how many -F you want).

giving output like:

# ausearch -i -k track-guido-development
----
type=PROCTITLE msg=audit(03/05/2015 22:04:40.893:365951) : proctitle=vim /home/guido/Development/git/eduFXserver.git/pom.xml 
type=PATH msg=audit(03/05/2015 22:04:40.893:365951) : item=0 name=/home/guido/Development/git/eduFXserver.git/.pom.xml.swp inode=11146444 dev=08:05 mode=file,600 ouid=guido ogid=guido rdev=00:00 obj=unconfined_u:object_r:user_home_t:s0 nametype=NORMAL 
type=CWD msg=audit(03/05/2015 22:04:40.893:365951) :  cwd=/home/guido 
type=SYSCALL msg=audit(03/05/2015 22:04:40.893:365951) : arch=x86_64 syscall=getxattr success=yes exit=37 a0=0x241e6d0 a1=0x7fc8479afcee a2=0x241e720 a3=0xff items=1 ppid=784 pid=9231 auid=guido uid=guido gid=guido euid=guido suid=guido fsuid=guido egid=guido sgid=guido fsgid=guido tty=pts3 ses=1 comm=vim exe=/usr/bin/vim subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=track-guido-development 
----
type=PROCTITLE msg=audit(03/05/2015 22:04:40.893:365953) : proctitle=vim /home/guido/Development/git/eduFXserver.git/pom.xml 
type=PATH msg=audit(03/05/2015 22:04:40.893:365953) : item=0 name=/home/guido/Development/git/eduFXserver.git/.pom.xml.swp inode=11146444 dev=08:05 mode=file,600 ouid=guido ogid=guido rdev=00:00 obj=unconfined_u:object_r:user_home_t:s0 nametype=NORMAL 
type=CWD msg=audit(03/05/2015 22:04:40.893:365953) :  cwd=/home/guido 
type=SYSCALL msg=audit(03/05/2015 22:04:40.893:365953) : arch=x86_64 syscall=getxattr success=yes exit=37 a0=0x241e6d0 a1=0x7fc8479afcee a2=0x241e720 a3=0xff items=1 ppid=784 pid=9231 auid=guido uid=guido gid=guido euid=guido suid=guido fsuid=guido egid=guido sgid=guido fsgid=guido tty=pts3 ses=1 comm=vim exe=/usr/bin/vim subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=track-guido-development 
----

which still will contain lots of unwanted stuff, but much better. If system becomes unresponsive because one of your rules taking over, you can execute:

# auditctl -R /etc/audit/audit.rules

as a panic mode to reset to default (empty) rules.

Related Question