Lesson 2.51: Auditing every program a person runs
Shell history can be switched off, edited or bypassed; the kernel's audit system can't be by an ordinary user. A syscall rule on execve records every program a logged-in person starts, with its full command line, working directory and the login identity behind it. In the lab Northwind's HR file server has such a rule since yesterday. You read the rules, summarise what was run and by whom, follow one contractor's session from listing payroll to uploading it, decode a raw record, and close a 32-bit gap the rule left open.
19 min
You will learn to
- Read loaded audit rules and status
- Explain an execve syscall rule and its filters
- Summarise activity with aureport
- Follow one user's commands with ausearch
- Decode raw records and cover both ABIs
Key terms
- Linux audit
- A kernel subsystem that records events matching rules; auditd writes them to /var/log/audit/audit.log.
- Syscall rule
- -a always,exit -S NAME: record whenever that system call returns, filtered with -F.
- auid (login UID)
- The UID a person logged in with; it doesn't change with sudo or su.
- arch=b64 / b32
- Which system call table the rule watches; 32-bit programs use b32.
- ausearch / aureport
- Search events by key, user, program, time / summarise them.
- PROCTITLE
- The full command line, hex-encoded in raw records.
← Memory limits and the OOM killer · All lessons · Finding hidden processes in a memory image →