auditd: auditing syscall with flags

Solution Verified - Updated -

Issue

The objective is to audit a syscall but with a filter on an argument used by the application.

  • For example: the need is to create a rule that will monitor all usage of "chattr -i" on any file/directory.

  • The issue is that the rule used:

-a always,exit -F arch=b64 -S ioctl -F a1=0x40086602 -F key=chattr

is showing all usage of chattr but not only the chattr -i as we would like.

Environment

  • RHEL
  • auditd

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.