selinux audit rule not logging anything

Question

I am trying to audit a directory tree for read, write, and permissions change. I created the rule using auditctl -w <path> -k media-watch, but ausearch -k media-watch only shows the creation (or deletion for debugging) of the rule, and not file creation or changes within the specified directory or below it in the tree. Selinux is disabled, if that's relevant.

Why? How can I make sure file access/changes are logged for auditing?

Answer 1

The man page says that -w is deprecated, so I wouldn't be using it. I'd be using the current format for such a rule instead. For example:

auditctl -a always,exit -F dir=/path/to/dir/ -k media-watch

Answer 2

I will argue with @Michael Hampton, about making all the rules in the format that he suggested. But I will agree with him on get guidance from the man page of the Linux Audit Kernel [1].

According to the manual, there are 3 types of rules control, file (Which is what @RedTedRedemption is trying to do) and system calls (Which is what @Michael is suggesting)

In your rule to track the modifications on the file of read, write, and change of permissions you need to add the modifier -p with these options:

• w = write
• a = change permissions or access
• r = read

I think @RedTedRedemption is on the right path, setting up a rule to watch for modifications in a specific directory. However, you need to establish this rule as permanent in the audit.rules file under /etc/audit/ directory. Otherwise, every time the audit daemon restarts, or the server restarts, the default rules will be applied again, and your settings will no longer be logging to the /var/log/audit/audit.log file.

To set up your rule to watch for the directory permanently, this is the line that you must type over the rules setting file under /etc/audit/audit.rules

-w </your/file/path> -p war -k <your-key> In addition, you need to comment or delete these rules from there too:

# First rule – delete all
#-D

# Disable system call auditing.
# Remove the following line if you need the auditing.
#-a never,task

Because the above control rules are overriding and deleting all following rules on reload

And then, when you apply your changes to the audit.rules, run these commands:

• service auditd reload or systemctl auditd reload
• service auditd restart or systemctl auditd restart

Finally, to query for audit logs related to your rule you will need to run these commands:

• sudo ausearch -i -k <your-key> -> To search for events related to your rule key
• sudo aureport -k -> To print in screen an audit report organized by rule’s keys
• sudo aureport -f -> To print in screen an audit report organized by file’s names

References: https://linux.die.net/man/7/audit.rules [1]