Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 403

IMPORTANT: Auditing System Calls
Auditing system calls results in a high logging activity, which in turn puts a
heavy load on the kernel. With a kernel less responsive than usual, the system's
backlog and rate limits might well be exceeded. Carefully evaluate which system
calls to include in your audit rule set and adjust the log settings accordingly.
See Section 30.2, "Configuring the Audit Daemon"
how to tweak the relevant settings.
The access system call checks whether a process would be allowed to read, write or
test for the existence of a file or file system object. Using the -F filter flag, build rules
matching specific access calls in the format-F a1=access_mode. Check /usr/
include/fcntl.h for a list of possible arguments to the access system call.
-a entry,always -S access -F a1=4
-a entry,always -S access -F a1=6
-a entry,always -S access -F a1=7
Audit the access system call, but only if the second argument of the system call
(mode) is 4 (R_OK). This rule filters for all access calls testing for sufficient write
permissions to a file or file system object accessed by a user or process.
Audit the access system call, but only if the second argument of the system call
(mode) is 6, meaning 4 OR 2, which translates to R_OK OR W_OK. This rule
filters for access calls testing for sufficient read and write permissions.
Audit the access system call, but only if the second argument of the system call
(mode) is 7, meaning 4 OR 2 OR 1, which translates to R_OK OR W_OK
OR X_OK. This rule filters for access calls testing for sufficient read, write, and
execute permissions.
The socketcall system call is a multiplexed system call. Multiplexed means that there
is only one system call for all possible calls and that libc passes the actual system call
to use as the first argument (a0). Check the manual page of socketcall for possible
system calls and refer to /usr/src/linux/include/linux/net.h for a list
of possible argument values and system call names. Audit supports filtering for specific
system calls using a -F a0=syscall_number.
(page 339) for details on
Introducing an Audit Rule Set 391