In this lesson, you will learn how to use the Linux Audit Framework (auditd) to track exactly when critical configuration files are accessed or modified on your system.
The Role of Auditing
While filesystem tools like btrfs help manage storage health and integrity, they don't natively record who touched a specific configuration file or when they did it. To bridge this gap, Linux uses the auditd subsystem. This acts as a kernel-level watcher that monitors system calls related to files—such as opening, writing, or changing permissions—and logs those events to a dedicated security file.
Setting Up a Watch Rule
To monitor a sensitive file, like /etc/passwd or a Btrfs mount configuration, you define a "watch" rule. You tell the audit daemon the file path and the permissions you want to trigger an alert for.
For example, to audit any write access or attribute changes to the /etc/shadow file, you would run the following command as root:
auditctl -w /etc/shadow -p wa -k shadow-access
Breaking down this command:
-w /etc/shadow: Specifies the path to the file you are watching.-p wa: Sets the permissions to watch:w(write) anda(attribute changes).-k shadow-access: Assigns a unique key to the event, making it easy to filter search results later.
Retrieving Audit Logs
Once the rule is active, every time a user or process modifies that file, the kernel logs the activity. You can inspect these logs using the ausearch utility:
ausearch -k shadow-access
This command will output the time, the user ID of the person who made the change, the command they used, and the result of the action. By placing these audit hooks on your most critical configuration files, you ensure that no unauthorized changes occur silently. This creates a forensic trail that complements your filesystem management strategies, ensuring that while your Btrfs storage remains robust and healthy, you also maintain full visibility into administrative activity.
Key Takeaway: The Linux audit framework allows you to attach persistent watches to critical files, providing a detailed log of every modification attempt to ensure system integrity and accountability.