From owner-freebsd-security@FreeBSD.ORG Sun Sep 30 00:38:37 2007 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 61DDA16A419 for ; Sun, 30 Sep 2007 00:38:37 +0000 (UTC) (envelope-from dexterclarke@Safe-mail.net) Received: from tapuz.safe-mail.net (tapuz.safe-mail.net [213.8.161.230]) by mx1.freebsd.org (Postfix) with ESMTP id 1EB4013C45B for ; Sun, 30 Sep 2007 00:38:37 +0000 (UTC) (envelope-from dexterclarke@Safe-mail.net) Received: by tapuz.safe-mail.net with Safe-mail (Exim 4.52) id 1Iblog-0002Se-Qk for freebsd-security@freebsd.org; Sat, 29 Sep 2007 19:33:46 -0400 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=N1-0105; d=Safe-mail.net; b=rY3GyA/+zmNsrTBNvAXW5fGmmdqgckSxnEyzfwrQxVhyyCH+oVywggFvXznJ7DWY kNeQZn8il1TwFX+E9H92vL/T7pB+SrE3j11TLlfyonjie99ntA+f2GZejO0UFPZo Xq4Iv/TQ88yIvwzSM9rgxCuVNGyvHFM2+khFdy4XLdc=; Received: from pc ([81.86.41.187]) by Safe-mail.net with https Date: Sat, 29 Sep 2007 19:33:46 -0400 From: dexterclarke@Safe-mail.net To: freebsd-security@freebsd.org X-SMType: Regular X-SMRef: N1-Gj4SICimys Message-Id: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-SMSignature: AodkacGTgZqTfwgQngX5GBe8gVjzOWWgVBEnNfbTYLDycpDQBcg93XdFpOmzM+cB ftkKjBvlVbOpJ6TusQa0Wd9ZiW03emLvHiil53I1Ng0X8cAFVoAmGDU/D4tBnexo /eIBu7nu9uJMzVAjeJBfogysPbjpJo3BCLiEmY/zU/o= Subject: Why are most audit events apparently non-attributable? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 30 Sep 2007 00:38:37 -0000 So I'm exploring AUDIT and have this in /etc/security/audit_control: dir:/var/audit flags:lo,fd minfree:20 naflags:lo policy:cnt filesz:0 I tell auditd to reread the config file with audit -s but no file deletion events are logged. I change the config file to: dir:/var/audit flags:lo minfree:20 naflags:lo,fd policy:cnt filesz:0 I type audit -s and am immediately flooded with 20 kilobytes worth of audit records about file deletions. What I don't understand is why these file deletions are non-attributable? Surely if I sit there touching and removing files, the events should be very cleary attributed to me? Even more strange is that the events look like this: header,130,10,unlink(2),0,Sat Sep 29 20:48:46 2007, + 957 msec path,/var/tmp/vi.recover/vi.zhcey0 attribute,600,root,wheel,126,24774,98340 subject,-1,root,wheel,root,wheel,78355,0,0,0.0.0.0 return,success,0 trailer,130 To me, that looks like the event was attributed to 'root', so why does it only appear when using 'naflags' ie. non attributable events? Perhaps I misunderstand something fundamental. -- dc