Ordinary permissions and a service's log do not say who wrote to a file. auditd answers that question — the kernel audit service: by a rule it records every access to a file along with who made it.
In the image auditd is off — you start it first:
With auditd running, the AppArmor denials from the previous lesson go to its log, /var/log/audit/audit.log: sudo ausearch -m AVC -i gets them, and journalctl -k has no new lines (in the Wiki).
An audit rule is set with auditctl:
-w is the path to watch; -p wa is which access to record (w for write, a for attribute change, also r for read and x for execute); -k hosts is a key by which you later search for events. sudo auditctl -l shows the installed rules.
Events for a key are fetched with ausearch:
Set a watch on /etc/hosts
Start the auditd service and set a watch on /etc/hosts with the key hosts for writes and attribute changes. Within a few seconds an event under that key must appear in the audit — the service edits the file again right then.
Goals · 0 of 2
- Start the auditd service not done yet
- Set a watch on /etc/hosts with the key hosts not done yet