The other day I set up a little shell script on a Debian server to send me an email when files change; it looks like this:
#!/bin/sh items=`find /var/www/vhosts -regex ".*/httpdocs/.*" -newer files_start -ls` if [ ! -z "$items" ] then touch files_start echo "$items" | mail -s "new file(s)" "firstname.lastname@example.org" fi
I kept getting notified of one mysterious 0-length text file (web-accessible, writable by PHP and the vhost user, but not Apache) getting modified 2-3 times a day, so I set up auditd with the following rule.
auditctl -l LIST_RULES: exit,always watch=/var/www/vhosts/path/to/file.txt perm=rwa key=wh1
I tested it and with ausearch got, as expected:
After getting the next email with the new mod date, I ran ausearch: no new matches!
How can this happen?
I discovered by other means that the process is PHP running as fastCGI invoked by Apache. The PHP function call is:
So the question becomes: How does fastCGI PHP alter a file and escape detection by auditd? This is beginning to look like an auditd bug.