linux rename使用

最近要对rename （系统调用号 82） 系统调用进行审计，使用mv 没有对应的信息产生，

最后选择rename来实现。

man rename

使用方式是：

例如需要把 test100 改成 test1

rename  test100 test1 test100

上面就会执行 rename 系统调用

如果开启了 auditd 审计，就会有如下信息：

 

type=SYSCALL msg=audit(1565337021.574:93299): arch=c000003e syscall=59 success=yes exit=0 a0=19b92e0 a1=198c4d0 a2=19b8fa0 a3=7fffd137a5e0 items=2 ppid=7220 pid=10844 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=1 comm="rename" exe="/usr/bin/rename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=EXECVE msg=audit(1565337021.574:93299): argc=4 a0="rename" a1="test100" a2="test1" a3="test100"
type=CWD msg=audit(1565337021.574:93299):  cwd="/home/admin"
type=PATH msg=audit(1565337021.574:93299): item=0 name="/usr/bin/rename" inode=5198 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=PATH msg=audit(1565337021.574:93299): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=33561677 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=SYSCALL msg=audit(1565337021.575:93300): arch=c000003e syscall=9 success=yes exit=140594913067008 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=7220 pid=10844 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=1 comm="rename" exe="/usr/bin/rename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=SYSCALL msg=audit(1565337021.575:93301): arch=c000003e syscall=2 success=yes exit=3 a0=7fdecdb994c4 a1=80000 a2=1 a3=7fdecdd9f4f8 items=1 ppid=7220 pid=10844 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=1 comm="rename" exe="/usr/bin/rename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=CWD msg=audit(1565337021.575:93301):  cwd="/home/admin"
type=PATH msg=audit(1565337021.575:93301): item=0 name="/etc/ld.so.cache" inode=67464620 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:ld_so_cache_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=SYSCALL msg=audit(1565337021.575:93302): arch=c000003e syscall=9 success=yes exit=140594913026048 a0=0 a1=9e97 a2=1 a3=2 items=0 ppid=7220 pid=10844 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=1 comm="rename" exe="/usr/bin/rename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=MMAP msg=audit(1565337021.575:93302): fd=3 flags=0x2
type=SYSCALL msg=audit(1565337021.575:93303): arch=c000003e syscall=2 success=yes exit=3 a0=7fdecdd9c640 a1=80000 a2=7fdecdd9f150 a3=7fdecdd9c640 items=1 ppid=7220 pid=10844 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=1 comm="rename" exe="/usr/bin/rename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=CWD msg=audit(1565337021.575:93303):  cwd="/home/admin"
type=PATH msg=audit(1565337021.575:93303): item=0 name="/lib64/libc.so.6" inode=33556358 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:lib_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=SYSCALL msg=audit(1565337021.575:93304): arch=c000003e syscall=9 success=yes exit=140594906853376 a0=0 a1=3cc1e0 a2=5 a3=802 items=0 ppid=7220 pid=10844 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=1 comm="rename" exe="/usr/bin/rename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=MMAP msg=audit(1565337021.575:93304): fd=3 flags=0x802
type=SYSCALL msg=audit(1565337021.575:93305): arch=c000003e syscall=10 success=yes exit=0 a0=7fdecd971000 a1=200000 a2=0 a3=802 items=0 ppid=7220 pid=10844 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=1 comm="rename" exe="/usr/bin/rename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=SYSCALL msg=audit(1565337021.575:93306): arch=c000003e syscall=9 success=yes exit=140594910793728 a0=7fdecdb71000 a1=6000 a2=3 a3=812 items=0 ppid=7220 pid=10844 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=1 comm="rename" exe="/usr/bin/rename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=MMAP msg=audit(1565337021.575:93306): fd=3 flags=0x812
type=SYSCALL msg=audit(1565337021.575:93307): arch=c000003e syscall=9 success=yes exit=140594910818304 a0=7fdecdb77000 a1=41e0 a2=3 a3=32 items=0 ppid=7220 pid=10844 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=1 comm="rename" exe="/usr/bin/rename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=SYSCALL msg=audit(1565337021.575:93308): arch=c000003e syscall=9 success=yes exit=140594913021952 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=7220 pid=10844 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=1 comm="rename" exe="/usr/bin/rename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=SYSCALL msg=audit(1565337021.575:93309): arch=c000003e syscall=9 success=yes exit=140594913013760 a0=0 a1=2000 a2=3 a3=22 items=0 ppid=7220 pid=10844 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=1 comm="rename" exe="/usr/bin/rename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=SYSCALL msg=audit(1565337021.575:93310): arch=c000003e syscall=10 success=yes exit=0 a0=7fdecdb71000 a1=4000 a2=1 a3=7fff6f536c30 items=0 ppid=7220 pid=10844 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=1 comm="rename" exe="/usr/bin/rename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=SYSCALL msg=audit(1565337021.575:93311): arch=c000003e syscall=10 success=yes exit=0 a0=601000 a1=1000 a2=1 a3=0 items=0 ppid=7220 pid=10844 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=1 comm="rename" exe="/usr/bin/rename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=SYSCALL msg=audit(1565337021.575:93312): arch=c000003e syscall=10 success=yes exit=0 a0=7fdecdd9d000 a1=1000 a2=1 a3=0 items=0 ppid=7220 pid=10844 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=1 comm="rename" exe="/usr/bin/rename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=SYSCALL msg=audit(1565337021.575:93313): arch=c000003e syscall=2 success=yes exit=3 a0=7fdecd93a9c0 a1=80000 a2=ffffffff a3=21000 items=1 ppid=7220 pid=10844 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=1 comm="rename" exe="/usr/bin/rename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=CWD msg=audit(1565337021.575:93313):  cwd="/home/admin"
type=PATH msg=audit(1565337021.575:93313): item=0 name="/usr/lib/locale/locale-archive" inode=67164371 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:locale_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=SYSCALL msg=audit(1565337021.575:93314): arch=c000003e syscall=9 success=yes exit=140594800775168 a0=0 a1=65293b0 a2=1 a3=2 items=0 ppid=7220 pid=10844 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=1 comm="rename" exe="/usr/bin/rename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=MMAP msg=audit(1565337021.575:93314): fd=3 flags=0x2
type=SYSCALL msg=audit(1565337021.575:93315): arch=c000003e syscall=82 success=yes exit=0 a0=7fff6f5387a8 a1=1432030 a2=1432035 a3=7fff6f5379e0 items=4 ppid=7220 pid=10844 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=1 comm="rename" exe="/usr/bin/rename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=CWD msg=audit(1565337021.575:93315):  cwd="/home/admin"