Mastering Linux Security and Hardening - Second Edition

Searching for directory access rule violations

In our next scenario, we created a shared directory for Vicky and Cleopatra and created an audit rule for it that looks like this:

sudo auditctl -w /secretcats/ -k secretcats_watch

So, all access or attempted access to this directory should trigger an alert. First, let's have Vicky enter the /secretcats directory and run an ls -l command:

[vicky@localhost ~]$ cd /secretcats[vicky@localhost secretcats]$ ls -ltotal 4-rw-rw-r--. 1 cleopatra secretcats 31 Dec 12 11:49 cleopatrafile.txt[vicky@localhost secretcats]$

Here, we can that Cleopatra has already been there and has created a file. (We'll get back to that in a moment.) When an event triggers an auditd rule, it often creates multiple records ...