0

I want to monitor process startup on El Capitan.

Darwin MaeLucirdosiMac.home 15.5.0 Darwin Kernel Version 15.5.0: Tue Apr 19 18:36:36 PDT 2016; root:xnu-3248.50.21~8/RELEASE_X86_64 x86_64

Below is my configuration. I have added the ,pc to line 2

bash-3.2# cat /etc/security/audit_control
#
# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_control#8 $
#
dir:/var/audit
flags:lo,aa,pc
minfree:5
naflags:lo,aa
policy:cnt,argv
filesz:2M
expire-after:10M
superuser-set-sflags-mask:has_authenticated,has_console_access
superuser-clear-sflags-mask:has_authenticated,has_console_access
member-set-sflags-mask:
member-clear-sflags-mask:has_authenticated

bash-3.2# ```

I can start and stop the service with launchctl, and the pid does change, but I can't load and unload it. Its not clear to me if that is necessary.

bash-3.2# launchctl list |grep audit - 0 com.apple.auditd bash-3.2# launchctl unload -w /System/Library/LaunchDaemons/com.apple.auditd.plist /System/Library/LaunchDaemons/com.apple.auditd.plist: Operation not permitted while System Integrity Protection is engaged bash-3.2# launchctl start com.apple.auditd bash-3.2# launchctl list |grep audit 5493 0 com.apple.auditd bash-3.2# launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist /System/Library/LaunchDaemons/com.apple.auditd.plist: service already loaded bash-3.2# launchctl stop com.apple.auditd bash-3.2# launchctl start com.apple.auditd bash-3.2# launchctl list |grep audit 5500 0 com.apple.auditd bash-3.2#

However, what is clear to me is that despite all the restarts and processes I launch, nothing seems to be written to the current log, which is not the most current timestamp wise and praudit shows nothing about processes.

bash-3.2# ls -trl /var/audit/ . . . . -r--r----- 1 root wheel 125 Jun 20 18:16 20160620215442.20160620221602 -r--r----- 1 root wheel 250 Jun 20 18:17 20160620221602.20160620221734 -r--r----- 1 root wheel 250 Jun 20 19:16 20160620221734.20160620231602 -r--r----- 1 root wheel 125 Jun 20 19:17 20160620231602.20160620231733 -r--r----- 1 root wheel 250 Jun 20 20:16 20160620231733.20160621001602 -r--r----- 1 root wheel 125 Jun 20 20:17 20160621001602.20160621001734 -r--r----- 1 root wheel 250 Jun 20 21:16 20160621001734.20160621011602 -r--r----- 1 root wheel 125 Jun 20 21:17 20160621011602.20160621011733 -r--r----- 1 root wheel 125 Jun 20 21:18 20160621011733.20160621011807 lrwxr-xr-x 1 root wheel 40 Jun 20 21:18 current -> /var/audit/20160621011843.not_terminated -r--r----- 1 root wheel 0 Jun 20 21:18 20160621011843.not_terminated -r--r----- 1 root wheel 250 Jun 20 21:18 20160621011807.20160621011843 bash-3.2# praudit -l /var/audit/20160621011807.20160621011843 header,125,11,session start,0,Mon Jun 20 21:18:14 2016, + 120 msec,argument,1,0x0,sflags,argument,2,0x0,am_success,argument,3,0x0,am_failure,subject,-1,root,wheel,root,wheel,0,100118,0,0.0.0.0,return,success,0,trailer,125, header,125,11,session end,0,Mon Jun 20 21:18:43 2016, + 771 msec,argument,1,0x0,sflags,argument,2,0x0,am_success,argument,3,0x0,am_failure,subject,-1,root,wheel,root,wheel,0,100118,0,0.0.0.0,return,success,0,trailer,125, bash-3.2# praudit -l /var/audit/current bash-3.2#

How do I get audit to reread the configuration files?

  • This is a pretty non-standard use case. What are you doing? – ewwhite Jun 21 '16 at 2:03
  • @ewwhite An app periodically starts on the desktop in question, and complains it can't find the JDK. I don't know what that process is. If this was a windows machine, I would just keep Sysinternals Process Monitor running filtering for ProcessCreate and ProcessStart events limited to a million and drop filtered events. It seems dtruss would be the better tool to use on unix, except El Capitan broke it. Perhaps OMI filters instead? – Justin Dearing Jun 21 '16 at 2:53
1

The correct way to do this is to unload and reload the auditd plist. For example:

sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.auditd.plist
sudo sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist

But be mindful of the catch22 here where El Capitan enabled by default SIPS, so you will get:

/System/Library/LaunchDaemons/com.apple.auditd.plist: Operation not permitted while System Integrity Protection is engaged

You will need to restart for audit rule changes to take effect. Stopping and starting the launch daemon with launchctl {stop,start} com.apple.auditd does not re-read the audit_control file.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.