With the man manual, I know some information about auditctl. But with the option -w path, I found some information as follow:
Insert a watch for the file system object at path. You cannot insert a watch to the top level directory. This is prohibited by the kernel. Wildcards are not supported either and will generate a warning.
According to my understanding, I think the command auditctl -w / could not insert a watch to the top level directory. But with my test in CentOS, I found that is OK?
The result test information:
[centos@localhost ~]$ sudo auditctl -w /
[centos@localhost ~]$ sudo auditctl -l
-w / -p rwxa
[centos@localhost ~]$ cd /
[centos@localhost /]$ pwd
/
[centos@localhost /]$ ll
total 24
-rw-r--r--. 1 root root 0 Mar 13 17:01 1
lrwxrwxrwx. 1 root root 7 Mar 13 16:56 bin -> usr/bin
dr-xr-xr-x. 4 root root 4096 Mar 13 17:15 boot
drwxr-xr-x. 20 root root 3320 Mar 14 02:15 dev
drwxr-xr-x. 142 root root 8192 Mar 14 02:14 etc
drwxr-xr-x. 3 root root 20 Mar 13 17:12 home
lrwxrwxrwx. 1 root root 7 Mar 13 16:56 lib -> usr/lib
lrwxrwxrwx. 1 root root 9 Mar 13 16:56 lib64 -> usr/lib64
drwxr-xr-x. 2 root root 6 Nov 5 11:38 media
-rw-r--r--. 1 root root 0 Mar 13 21:40 mmm
drwxr-xr-x. 2 root root 6 Nov 5 11:38 mnt
drwxr-xr-x. 3 root root 16 Mar 13 17:08 opt
dr-xr-xr-x. 219 root root 0 Mar 14 02:14 proc
dr-xr-x---. 6 root root 234 Mar 13 11:53 root
drwxr-xr-x. 40 root root 1180 Mar 14 02:15 run
lrwxrwxrwx. 1 root root 8 Mar 13 16:56 sbin -> usr/sbin
drwxr-xr-x. 2 root root 6 Nov 5 11:38 srv
dr-xr-xr-x. 13 root root 0 Mar 14 02:14 sys
drwxrwxrwt. 42 root root 4096 Mar 14 04:04 tmp
drwxr-xr-x. 2 root root 6 Mar 13 21:40 ttt
drwxr-xr-x. 13 root root 155 Mar 13 16:56 usr
drwxr-xr-x. 21 root root 4096 Mar 14 02:14 var
[centos@localhost /]$ sudo mkdir alex
[centos@localhost /]$ sudo touch alexzl
[centos@localhost /]$ ll
total 24
-rw-r--r--. 1 root root 0 Mar 13 17:01 1
drwxr-xr-x. 2 root root 6 Mar 14 04:17 alex
-rw-r--r--. 1 root root 0 Mar 14 04:17 alexzl
lrwxrwxrwx. 1 root root 7 Mar 13 16:56 bin -> usr/bin
dr-xr-xr-x. 4 root root 4096 Mar 13 17:15 boot
drwxr-xr-x. 20 root root 3320 Mar 14 02:15 dev
drwxr-xr-x. 142 root root 8192 Mar 14 02:14 etc
drwxr-xr-x. 3 root root 20 Mar 13 17:12 home
lrwxrwxrwx. 1 root root 7 Mar 13 16:56 lib -> usr/lib
lrwxrwxrwx. 1 root root 9 Mar 13 16:56 lib64 -> usr/lib64
drwxr-xr-x. 2 root root 6 Nov 5 11:38 media
-rw-r--r--. 1 root root 0 Mar 13 21:40 mmm
drwxr-xr-x. 2 root root 6 Nov 5 11:38 mnt
drwxr-xr-x. 3 root root 16 Mar 13 17:08 opt
dr-xr-xr-x. 218 root root 0 Mar 14 02:14 proc
dr-xr-x---. 6 root root 234 Mar 13 11:53 root
drwxr-xr-x. 40 root root 1180 Mar 14 02:15 run
lrwxrwxrwx. 1 root root 8 Mar 13 16:56 sbin -> usr/sbin
drwxr-xr-x. 2 root root 6 Nov 5 11:38 srv
dr-xr-xr-x. 13 root root 0 Mar 14 02:14 sys
drwxrwxrwt. 42 root root 4096 Mar 14 04:04 tmp
drwxr-xr-x. 2 root root 6 Mar 13 21:40 ttt
drwxr-xr-x. 13 root root 155 Mar 13 16:56 usr
drwxr-xr-x. 21 root root 4096 Mar 14 02:14 var
[centos@localhost /]$ sudo ausearch -f /
.............
.............
time->Tue Mar 14 04:17:00 2017
type=PATH msg=audit(1489479420.957:1682): item=1 name="alex" objtype=CREATE
type=PATH msg=audit(1489479420.957:1682): item=0 name="/" inode=64 dev=fd:00 mode=040555 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:root_t:s0 objtype=PARENT
type=CWD msg=audit(1489479420.957:1682): cwd="/"
type=SYSCALL msg=audit(1489479420.957:1682): arch=c000003e syscall=83 success=no exit=-13 a0=7ffeb030b435 a1=1ff a2=1ff a3=7ffeb030a370 items=2 ppid=3444 pid=5955 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=1 comm="mkdir" exe="/usr/bin/mkdir" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
.............
time->Tue Mar 14 04:17:39 2017
type=PATH msg=audit(1489479459.343:1915): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=33613563 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL
type=PATH msg=audit(1489479459.343:1915): item=0 name="/usr/bin/sudo" inode=1461019 dev=fd:00 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 objtype=NORMAL
type=CWD msg=audit(1489479459.343:1915): cwd="/"
type=EXECVE msg=audit(1489479459.343:1915): argc=3 a0="sudo" a1="touch" a2="alexzl"
type=BPRM_FCAPS msg=audit(1489479459.343:1915): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=0000001fffffffff new_pi=0000000000000000 new_pe=0000001fffffffff
type=SYSCALL msg=audit(1489479459.343:1915): arch=c000003e syscall=59 success=yes exit=0 a0=e21e00 a1=e99fb0 a2=e34670 a3=7ffe09a62fa0 items=2 ppid=3444 pid=5971 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=1 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
----
Why the man manual does not support insertion a watch to the top level directory, but the test is OK?
