Host Intrusion Detection System Administrator's Guide Release 3.0

Templates and Alerts
Modification of Another User’s File Template
Appendix A
166
NOTE Refer to Table B-1 in Appendix B for the definition of argv[10] through argv[32] that can
be used to access specific alert information (ie., pid, ppid) without having to parse the
string alert fields above.
Limitations None
argv[8] Details String “User with uid <uid> <performed action
on the file> <full
pathname>(type=<type>,inode=<inode
>, device<device) when executing
<program>(type=<type>,inode=<inode>
,device=<device>), invoked as follows:
<argv[0]> <argv[1]>..., as process with
pid <pid> and ppid <ppid> and running
with effective uid=<euid> and with
effective gid=<egid>.
where <performed action on the file> is
set to one of the following:
"changed the owner of"
"changed the permission of"
"opened for modification/truncation"
"renamed the file"
"created the file (and overwrote any
existing file) named"
"truncated the file"
"deleted the file"
"deleted the directory"
"performed system call <number> on
the file”
Detailed alert
description
argv[9] Local Time Integer <secs> Local time in
number of seconds
since epoch when
a world writable
file is created
Table A-18 Non-owned File Being Modified Alert Properties (Continued)
Response
Program
Argument
Alert
Field
Alert
Field Type
Alert Value/Format Description