auditctlAdd kernel audit rules: who touched what, and when
auditctl controls the Linux audit system in the kernel: it adds rules that record every write to a file like /etc/passwd or every use of a syscall, tagged with a key. auditd writes the events to /var/log/audit/audit.log, and ausearch and aureport find them. It's how you prove who changed a file, even as root.
auditctl -l | -s | -w PATH -p [r|w|x|a] -k KEY | -a always,exit -F arch=b64 -S SYSCALL [-F FIELD=VALUE]... -k KEY | -d ... | -D | -e 0|1|2A compliance review asks whether changes to critical files are recorded on this server.
sudoAudit rules are kernel state; changing or even listing them needs root (CAP_AUDIT_CONTROL).
The audit subsystem lives in the kernel. Rules you add with auditctl are sent over a netlink socket and evaluated at syscall exit (or for watches, on the inode): when an openat with write access hits a watched file, the kernel builds a record with the syscall, success, arguments, PID, UID, effective UID and, crucially, the auid, the login UID set at login time that stays the same through sudo and su. Records go to auditd over netlink, which appends them to /var/log/audit/audit.log; if auditd can't keep up, the kernel's backlog fills and events are lost (or, with failure mode 2, the system panics). A single event is several lines (SYSCALL, CWD, PATH, PROCTITLE) sharing one serial number. Rules from auditctl are lost at reboot; persistent rules go in /etc/audit/rules.d/*.rules and are compiled into audit.rules by augenrules. 'auditctl -e 2' locks the configuration until reboot so an attacker with root can't silently remove rules.
-lList the rules loaded in the kernel-sStatus: enabled, failure mode, auditd PID, lost events, backlog-w PATH -p rwxaWatch a file or directory for read/write/execute/attribute access-k KEYTag matching events so ausearch -k KEY finds them-a always,exit -S NAMESyscall rule: log every call of NAME (add -F arch=b64)-F auid>=1000 -F auid!=-1Only actions by real logged-in users-W PATH / -d RULEDelete a watch / delete a syscall rule-DDelete all rules-e 2Make the configuration immutable until rebootausearch -k KEY -iFind events by key, with numbers interpreted (uid -> name)aureport --auth / -xSummary reports: logins, executables...augenrules --loadLoad persistent rules from /etc/audit/rules.dAdding rules with auditctl and assuming they're permanentauditctl changes only the running kernel; everything is gone after reboot.
Put rules in /etc/audit/rules.d/*.rules and run sudo augenrules --loadWatching huge, busy directories with -p r (or auditing every syscall)Millions of events overload auditd, fill the disk and can make the kernel drop events (lost > 0) or slow the system.
Watch specific sensitive files for wa, filter syscall rules with -F (auid, euid, exit codes)Looking at uid to find who made a change via sudouid and euid show root; they don't identify the person.
Use auid (login UID), which ausearch -i shows as the original user's nameForgetting -F arch=b64 on syscall rules on a 64-bit systemSyscall numbers differ between 32- and 64-bit; without arch the rule may not match what you think (auditctl warns).
-a always,exit -F arch=b64 -S ... (and a second rule with arch=b32 if 32-bit binaries matter)Try these on a Linux machine of your own. Each task has a hint and a solution.
Check whether the audit system is enabled and how many events have been lost. The practice sandbox can't change the audit system: it belongs to the host kernel, which containers share, so auditctl reports 'Operation not permitted'. Write the commands and run them on a VM.
Watch ~/app for writes and attribute changes with the key app-change, edit a file in it, then find the event. The practice sandbox can't change the audit system: it belongs to the host kernel, which containers share, so auditctl reports 'Operation not permitted'. Write the commands and run them on a VM.
Remove that watch again and confirm no rules are left. The practice sandbox can't change the audit system: it belongs to the host kernel, which containers share, so auditctl reports 'Operation not permitted'. Write the commands and run them on a VM.
auditctlAdd kernel audit rules: who touched what, and when
auditctl controls the Linux audit system in the kernel: it adds rules that record every write to a file like /etc/passwd or every use of a syscall, tagged with a key. auditd writes the events to /var/log/audit/audit.log, and ausearch and aureport find them. It's how you prove who changed a file, even as root.
auditctl -l | -s | -w PATH -p [r|w|x|a] -k KEY | -a always,exit -F arch=b64 -S SYSCALL [-F FIELD=VALUE]... -k KEY | -d ... | -D | -e 0|1|2A compliance review asks whether changes to critical files are recorded on this server.
sudoAudit rules are kernel state; changing or even listing them needs root (CAP_AUDIT_CONTROL).
The audit subsystem lives in the kernel. Rules you add with auditctl are sent over a netlink socket and evaluated at syscall exit (or for watches, on the inode): when an openat with write access hits a watched file, the kernel builds a record with the syscall, success, arguments, PID, UID, effective UID and, crucially, the auid, the login UID set at login time that stays the same through sudo and su. Records go to auditd over netlink, which appends them to /var/log/audit/audit.log; if auditd can't keep up, the kernel's backlog fills and events are lost (or, with failure mode 2, the system panics). A single event is several lines (SYSCALL, CWD, PATH, PROCTITLE) sharing one serial number. Rules from auditctl are lost at reboot; persistent rules go in /etc/audit/rules.d/*.rules and are compiled into audit.rules by augenrules. 'auditctl -e 2' locks the configuration until reboot so an attacker with root can't silently remove rules.
-lList the rules loaded in the kernel-sStatus: enabled, failure mode, auditd PID, lost events, backlog-w PATH -p rwxaWatch a file or directory for read/write/execute/attribute access-k KEYTag matching events so ausearch -k KEY finds them-a always,exit -S NAMESyscall rule: log every call of NAME (add -F arch=b64)-F auid>=1000 -F auid!=-1Only actions by real logged-in users-W PATH / -d RULEDelete a watch / delete a syscall rule-DDelete all rules-e 2Make the configuration immutable until rebootausearch -k KEY -iFind events by key, with numbers interpreted (uid -> name)aureport --auth / -xSummary reports: logins, executables...augenrules --loadLoad persistent rules from /etc/audit/rules.dAdding rules with auditctl and assuming they're permanentauditctl changes only the running kernel; everything is gone after reboot.
Put rules in /etc/audit/rules.d/*.rules and run sudo augenrules --loadWatching huge, busy directories with -p r (or auditing every syscall)Millions of events overload auditd, fill the disk and can make the kernel drop events (lost > 0) or slow the system.
Watch specific sensitive files for wa, filter syscall rules with -F (auid, euid, exit codes)Looking at uid to find who made a change via sudouid and euid show root; they don't identify the person.
Use auid (login UID), which ausearch -i shows as the original user's nameForgetting -F arch=b64 on syscall rules on a 64-bit systemSyscall numbers differ between 32- and 64-bit; without arch the rule may not match what you think (auditctl warns).
-a always,exit -F arch=b64 -S ... (and a second rule with arch=b32 if 32-bit binaries matter)Try these on a Linux machine of your own. Each task has a hint and a solution.
Check whether the audit system is enabled and how many events have been lost. The practice sandbox can't change the audit system: it belongs to the host kernel, which containers share, so auditctl reports 'Operation not permitted'. Write the commands and run them on a VM.
Watch ~/app for writes and attribute changes with the key app-change, edit a file in it, then find the event. The practice sandbox can't change the audit system: it belongs to the host kernel, which containers share, so auditctl reports 'Operation not permitted'. Write the commands and run them on a VM.
Remove that watch again and confirm no rules are left. The practice sandbox can't change the audit system: it belongs to the host kernel, which containers share, so auditctl reports 'Operation not permitted'. Write the commands and run them on a VM.