All,

I've been running in compliance with this rule for quite some time now and I'm noticing that the amount of noise that it produces is simply outrageous.

The suggestion is:

At a minimum the audit system should collect file permission changes for all users and root. Add the following to "/etc/audit/audit.rules":

-a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 \
-k perm_mod

If the system is 64 bit then also add the following:

-a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 \
-k perm_mod

And here is the output of a normal workstation over about a week of auditing and normal usage:

Syscall Summary Report
==========================
total  syscall
==========================
24907  chmod
15870  chown
11169  rename
7409  open
6462  fchmod
5290  fchown
3687  umount2
1443  setsid
1166  fsetxattr
869  removexattr
456  adjtimex
360  fchmodat
337  lchown
211  setuid
69  mkdir
63  setsockopt
33  unlink
22  setxattr
20  clone
19  execve
7  fchownat
7  mount
7  creat
4  close
4  ioctl
3  symlink
2  mknod
1  rmdir
1  lsetxattr
1  clock_settime
1  capset

So, I get why this can be useful. But I'm not so sure that it's useful to know that Pidgin dropped a new temp file every few minutes or that, each time I open a file (and write a temp file), that I did this as a normal user.

I just can't see the practicality of going through those top three calls on a regular basis.

I'm not necessarily suggesting that this type of thing be dropped but I'd like to understand how auditors won't fall into just ignoring them completely.

Thoughts?

Thanks,

Trevor
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan@onyxpoint.com

-- This account not approved for unencrypted proprietary information --