linux - 为什么不使用 auditctl 将 watch 插入顶级目录？

Question

通过man手册，我知道了一些关于auditctl的信息。但是通过选项-w path，我发现了一些信息如下:

Insert a watch for the file system object at path. You cannot insert a watch to the top level directory. This is prohibited by the kernel. Wildcards are not supported either and will generate a warning.

根据我的理解，我认为 auditctl -w/ 命令无法将 watch 插入到顶级目录。但是我在 CentOS 中测试，我发现可以吗？

结果测试信息:

[centos@localhost ~]$ sudo auditctl -w /
[centos@localhost ~]$ sudo auditctl -l
-w / -p rwxa
[centos@localhost ~]$ cd /
[centos@localhost /]$ pwd
/
[centos@localhost /]$ ll
total 24
-rw-r--r--.   1 root root    0 Mar 13 17:01 1
lrwxrwxrwx.   1 root root    7 Mar 13 16:56 bin -> usr/bin
dr-xr-xr-x.   4 root root 4096 Mar 13 17:15 boot
drwxr-xr-x.  20 root root 3320 Mar 14 02:15 dev
drwxr-xr-x. 142 root root 8192 Mar 14 02:14 etc
drwxr-xr-x.   3 root root   20 Mar 13 17:12 home
lrwxrwxrwx.   1 root root    7 Mar 13 16:56 lib -> usr/lib
lrwxrwxrwx.   1 root root    9 Mar 13 16:56 lib64 -> usr/lib64
drwxr-xr-x.   2 root root    6 Nov  5 11:38 media
-rw-r--r--.   1 root root    0 Mar 13 21:40 mmm
drwxr-xr-x.   2 root root    6 Nov  5 11:38 mnt
drwxr-xr-x.   3 root root   16 Mar 13 17:08 opt
dr-xr-xr-x. 219 root root    0 Mar 14 02:14 proc
dr-xr-x---.   6 root root  234 Mar 13 11:53 root
drwxr-xr-x.  40 root root 1180 Mar 14 02:15 run
lrwxrwxrwx.   1 root root    8 Mar 13 16:56 sbin -> usr/sbin
drwxr-xr-x.   2 root root    6 Nov  5 11:38 srv
dr-xr-xr-x.  13 root root    0 Mar 14 02:14 sys
drwxrwxrwt.  42 root root 4096 Mar 14 04:04 tmp
drwxr-xr-x.   2 root root    6 Mar 13 21:40 ttt
drwxr-xr-x.  13 root root  155 Mar 13 16:56 usr
drwxr-xr-x.  21 root root 4096 Mar 14 02:14 var
[centos@localhost /]$ sudo mkdir alex
[centos@localhost /]$ sudo touch alexzl
[centos@localhost /]$ ll
total 24
-rw-r--r--.   1 root root    0 Mar 13 17:01 1
drwxr-xr-x.   2 root root    6 Mar 14 04:17 alex
-rw-r--r--.   1 root root    0 Mar 14 04:17 alexzl
lrwxrwxrwx.   1 root root    7 Mar 13 16:56 bin -> usr/bin
dr-xr-xr-x.   4 root root 4096 Mar 13 17:15 boot
drwxr-xr-x.  20 root root 3320 Mar 14 02:15 dev
drwxr-xr-x. 142 root root 8192 Mar 14 02:14 etc
drwxr-xr-x.   3 root root   20 Mar 13 17:12 home
lrwxrwxrwx.   1 root root    7 Mar 13 16:56 lib -> usr/lib
lrwxrwxrwx.   1 root root    9 Mar 13 16:56 lib64 -> usr/lib64
drwxr-xr-x.   2 root root    6 Nov  5 11:38 media
-rw-r--r--.   1 root root    0 Mar 13 21:40 mmm
drwxr-xr-x.   2 root root    6 Nov  5 11:38 mnt
drwxr-xr-x.   3 root root   16 Mar 13 17:08 opt
dr-xr-xr-x. 218 root root    0 Mar 14 02:14 proc
dr-xr-x---.   6 root root  234 Mar 13 11:53 root
drwxr-xr-x.  40 root root 1180 Mar 14 02:15 run
lrwxrwxrwx.   1 root root    8 Mar 13 16:56 sbin -> usr/sbin
drwxr-xr-x.   2 root root    6 Nov  5 11:38 srv
dr-xr-xr-x.  13 root root    0 Mar 14 02:14 sys
drwxrwxrwt.  42 root root 4096 Mar 14 04:04 tmp
drwxr-xr-x.   2 root root    6 Mar 13 21:40 ttt
drwxr-xr-x.  13 root root  155 Mar 13 16:56 usr
drwxr-xr-x.  21 root root 4096 Mar 14 02:14 var
[centos@localhost /]$ sudo  ausearch  -f /

.............
.............
time->Tue Mar 14 04:17:00 2017
type=PATH msg=audit(1489479420.957:1682): item=1 name="alex" objtype=CREATE
type=PATH msg=audit(1489479420.957:1682): item=0 name="/" inode=64 dev=fd:00 mode=040555 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:root_t:s0 objtype=PARENT
type=CWD msg=audit(1489479420.957:1682):  cwd="/"
type=SYSCALL msg=audit(1489479420.957:1682): arch=c000003e syscall=83 success=no exit=-13 a0=7ffeb030b435 a1=1ff a2=1ff a3=7ffeb030a370 items=2 ppid=3444 pid=5955 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=1 comm="mkdir" exe="/usr/bin/mkdir" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)

.............

time->Tue Mar 14 04:17:39 2017
type=PATH msg=audit(1489479459.343:1915): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=33613563 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL
type=PATH msg=audit(1489479459.343:1915): item=0 name="/usr/bin/sudo" inode=1461019 dev=fd:00 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 objtype=NORMAL
type=CWD msg=audit(1489479459.343:1915):  cwd="/"
type=EXECVE msg=audit(1489479459.343:1915): argc=3 a0="sudo" a1="touch" a2="alexzl"
type=BPRM_FCAPS msg=audit(1489479459.343:1915): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=0000001fffffffff new_pi=0000000000000000 new_pe=0000001fffffffff
type=SYSCALL msg=audit(1489479459.343:1915): arch=c000003e syscall=59 success=yes exit=0 a0=e21e00 a1=e99fb0 a2=e34670 a3=7ffe09a62fa0 items=2 ppid=3444 pid=5971 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=1 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
----

为什么man手册不支持插入watch到顶级目录，但是测试OK？

Answer 1

我认为这个问题是它限制了在顶级目录而不是子目录或文件上插入监视。例如，如果要在根目录下插入watch，是禁止的，但是可以同时在子目录和文件中添加watch。