?????????? ????????? - ??????????????? - /home/agenciai/public_html/cd38d8/audit.tar
???????
sotruss-lib.so 0000755 00000036500 15125126675 0007416 0 ustar 00 ELF > � @ �5 @ 8 @ 0 0 E E l l �- �= �= � �- �= �= � � � � � 0 0 � � � D D S�td � � � 0 0 P�td ,! ,! ,! L L Q�td R�td �- �= �= 8 8 GNU � � � GNU 'rq �����g��X�tT GNU � �P 3�:����.����(�闒 o � U v � � ] � � � 3 � o ! � � � } � � � , Q ! F " ; � � � ` � � p d � � ` __gmon_start__ _ITM_deregisterTMCloneTable _ITM_registerTMCloneTable __cxa_finalize strncmp strchr la_version getenv getpid fcntl64 fdopen setlinebuf dup strtoul strlen __stpcpy snprintf open64 error __stack_chk_fail la_objopen basename __progname __progname_full la_symbind64 warnx la_x86_64_gnu_pltenter fprintf la_x86_64_gnu_pltexit program_invocation_short_name program_invocation_name libc.so.6 GLIBC_2.28 GLIBC_2.4 GLIBC_2.2.5 � ��� � ii � ui � �= @ �= �= �= �? �? �? �? �? �? @ @ (@ 0@ 8@ @@ H@ P@ X@ `@ h@ p@ x@ �@ �@ �@ �@ �@ �@ � �H��H��/ H��t��H��� �5�/ �%�/ � �h ������ �h ������� �h ������ �h ������ �h ������ �h ������ �h ������ �h ��q����� �h ��a����� �h ��Q����� �h ��A����� �h ��1����� �h ��!����� �h ������� �h ������� �h ����� �h ������ �h ������� �h ������ ��%�. D � ��%�. D � ��%�. D � ��%�. D � ��%�. D � ��%�. D � ��%}. D � ��%u. D � ��%m. D � ��%e. D � ��%]. D � ��%U. D � ��%M. D � ��%E. D � ��%=. D � ��%5. D � ��%-. D � ��%%. D � ��% . D H�=. H�. H9�tH�.- H��t �� � � � H�=�- H�5�- H)�H��H��?H��H�H�tH�- H��t��f D � � � ��=�- u+UH�=�, H��t H�=�* �Y����d����}- ]� � � � ��w��� � AUA��ATI��UH��SH��H��� � H�hH��L��H�������u �D <:t)��t%�: H������H��u�H��1�[]A\A]�f D H��D��[]A\A]�f. � � �UH��AWAVAUATSH��dH�%( H�E�1����; H�=� �W���H��, H��t �8 �R H�=� �6���H��, H��t �8 � H�=� ����1�H��t1Ҁ8 ��H�= �], ��H��� ���A��H��t �; �� �1, H�=X ����I��H��t �8 �� 1�1��� � ������tL��H�56 �^���H��+ H��H��t� ���H�E�dH+%( �T H�eظ [A\A]A^A_]� � �������t�� � 1�H�u�H���:���H�U��: �i���Ic�H9��]����;��� @ H�e+ ���� � H�U+ ���H��I������H��H�� H��H% �H)�H���H9�tH�� H��$� H9�u�� H)�H��tH�L� H��L��I���B���H��H��t�; uIc�H� � 1�����1��� �B L���+������t��* L����� @ L���t�����H�� 1�� �����N���ff. � � �AWAVAUATUSH��8H�=>* H�|$H�T$�6 L�gM��� A�<$ � L�����L��H�D$ �Y����8 H�D$�� H�|$���L�-�) L�=�) H�D$(H�D$H�X8H���� 1�E1��w D �} /tzM��t-A�} t&H�3H��H�4$�o���H�4$� L��H������A �M��t,A�? t&H�3H��H�4$�>���H�4$� L��H�����A �H�[H��t H��u�H�H��뇐H��8/u��y��� H��HDl$�} �� H�D$H�(M���� A�} t3H�T$ � L��L�����H�T$(H�t$L�� ���g��� �A �M���� A�? t3H�T$ � L��L���>���H�T$(H�t$L��� ���%��� �A �H��8D��[]A\A]A^A_�f D H��' H�(H�D$H�(M���Q���H�D$H�@�8 �����A �M���t���A��� � H�9' H� H�D$�!��� @ H�9' L� ���f � H��81�[]A\A]A^A_� � H�l$E1����ff. � � �UH��SL��H��A� uJ��' ��u� H�EH��[]� � �t�1�H�=" �����' ��t�H�EH��[]�H�=� 1��b����� �AWAVAUATI��UH��SH��H��HE�M�dH�%( H�D$81��)' M�H �D$) L��$� M�@(L�l$)L��$� ��usARA��H�B L��AQL� / H�M H�5� APLD�M�$1�AWH�=�& ����I� H�� H�CH�T$8dH+%( uaH��H[]A\A]A^A_� � L�D$L�L$L�T$D�\$�7���H�� � L��Hc�1��n���L�D$L�L$L�T$D�\$�B���� ���� �AVAUATUH��SH��H�� � $& M�1dH�%( H�D$1�L�l$P�D$ L�d$ ��uNAVL�E L��L� : AUH� H�50 1�H�=�% ����XZH�D$dH+%( u2H�� 1�[]A\A]A^� �k���H�� � L��Hc�1������k��� � �H��H��� cannot handle interface version %u cannot trace PLT enter (bind-now enabled) cannot trace PLT exit (bind-now enabled) %s%15s -> %-15s:%s%s(0x%lx, 0x%lx, 0x%lx) SOTRUSS_FROMLIST SOTRUSS_TOLIST SOTRUSS_EXIT SOTRUSS_WHICH SOTRUSS_OUTNAME .%ld w * %5ld: %s%15s -> %-15s:%s%s - 0x%lx ;H ��d 4� $� ��� 4��� ���� 4���� T��� zR x � $ ��@ FJ w� ?:*3$" D ��0 H \ x�v B�E�D �D(�G0C (C ABBG D(D ABB , � �� E�C M�����' D d � � F�B�B �B(�A0�A8�Dp� 8D0A(B BBBG | 8C0A(B BBBH 4 @ 4���p E�D�G ^ AAH e AAA \ x l��� F�B�B �B(�D0�D8�G�D�P�T�L�W�X 8A0A(B BBBH L � ,���� F�B�B �A(�D0�GPnXP`YXAPT 0C(A BBBD @ �= � 8 �= �= �# ���o X X � @ � h � � ���o ���o P ���o �o ���o �= 0 @ P ` p � � � � � � � � 0 @ P sotruss-lib.so-2.34-231.el9_7.2.x86_64.debug ����7zXZ �ִF ! t/���r] ?�E�h=��ڊ�2N��� ��b�t�q�`��Sզ�����fE�"zo����9���a�f�V�A���\�AU$M�瑿���� �Ȳz7R���fEč.2�� ʛ�����Xsr�����3}�Y�]�H� K�-�w���" Q���lhҬa�E6�<|Oy ��3���/�&/F��U+�.�ͻ����\�j\ p ^�bN���FM ��(P��'����:� �! �x|`�wR�`", .�q���5a���B>i���Y��_f�a�����.��.��H���<xhx�J�(w�H �߆oK�/�V5 � ;�r�XN1��Ѿ��ҁ��MVQ��ՁZ��6^���lM�t������ �~��X�g��DRT�輮�߃�yx�r{�R��v.H�m4��n5�E�i�&=9l%�䠋�D�ls��3���^�o�QlL=?iT�!�Ί��_t����,� �7:��7��/�j��F�t�pl�g}^h�,���~�8s�y,q}%����É>�&��ގ�+�%��� N�8��%��KRc�g�j��t�+� �ӝ�� �&�U�-/@g�L�q��7�3p� ��� XI%�o��F�$�'�T��w;� q��`���I I���Gw�Cb�X��H0!r�+��m�|�Xm#�li� 8�� zQ�X�S������?�JU�,��[?Ίf� �\S��h�W�:��`���6�<���0ۆ���>�q�� ���lE� MQ��t�,��f/���5jSKwC�Y �#acr �V���g�����Gw��`�^>��Yx�,i�d@P��s�ۡz�T��xb�*ش` h2ڳ�l�=�|H�m�����cp !�'�)a�C�틘�� ��Grh¸ � W�� H �� ¨jʱ�g� YZ .shstrtab .note.gnu.property .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.sec .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .data.rel.ro .dynamic .got .got.plt .bss .gnu_debuglink .gnu_debugdata � � 0 � � $ 1 � � ? ���o 8 I X X Q X X � Y ���o @ f ���o P P @ u � � � B h h � � � @ � ` ` 0 � � � � � 8 8 � 2 , � ,! ,! L � x! x! ( C �# �# � � �= �- � �= �- � �= �- � �= �- � � �? �/ 0 � @ 0 � �@ �0 ( �0 4 �0 � �4 # sample-rules/41-containers.rules 0000644 00000000667 15125660163 0012636 0 ustar 00 ## Use these rules if you want to log container events ## watch for container creation -a always,exit -F arch=b32 -S clone -F a0&0x7C020000 -F key=container-create -a always,exit -F arch=b64 -S clone -F a0&0x7C020000 -F key=container-create ## watch for containers that may change their configuration -a always,exit -F arch=b32 -S unshare,setns -F key=container-config -a always,exit -F arch=b64 -S unshare,setns -F key=container-config sample-rules/README-rules 0000644 00000002615 15125660163 0011176 0 ustar 00 This group of rules are meant to be used with the augenrules program. The augenrules program expects rules to be located in /etc/audit/rules.d/ The rules will get processed in a specific order based on their natural sort order. To make things easier to use, the files in this directory are organized into groups with the following meanings: 10 - Kernel and auditctl configuration 20 - Rules that could match general rules but we want a different match 30 - Main rules 40 - Optional rules 50 - Server Specific rules 70 - System local rules 90 - Finalize (immutable) There is one set of rules, 31-privileged.rules, that should be regenerated. There is a script in the comments of that file. You can uncomment the commands and run the script and then rename the resulting file. The rules are not meant to be used all at once. They are pieces of a policy that should be thought out and individual files copied to /etc/audit/rules.d/ For example, if you wanted to set a system up in the STIG configuration, copy rules 10-base-config, 30-stig, 31-privileged, and 99-finalize. You can add more if you like. Also, not all arches have the same syscalls. It is expected that the rules be fine tuned for the arch they are deployed on. For example, aarch64 does not have the open syscall. It should just be deleted from the rules. Once you have the rules in the rules.d directory, you can load them by running augenrules --load sample-rules/30-pci-dss-v31.rules 0000644 00000020274 15125660163 0012434 0 ustar 00 ## The purpose of these rules is to meet the pci-dss v3.1 auditing requirements ## These rules depends on having 10-base-config.rules & 99-finalize.rules ## installed. ## NOTE: ## 1) if this is being used on a 32 bit machine, comment out the b64 lines ## 2) These rules assume that login under the root account is not allowed. ## 3) It is also assumed that 1000 represents the first usable user account. To ## be sure, look at UID_MIN in /etc/login.defs. ## 4) If these rules generate too much spurious data for your tastes, limit the ## syscall file rules with a directory, like -F dir=/etc ## 5) You can search for the results on the key fields in the rules ## ## 10.1 Implement audit trails to link all access to individual user. ## This requirement is implicitly met ## 10.2.1 Implement audit trails to detect user accesses to cardholder data ## This would require a watch on the database that excludes the daemon's ## access. This rule is commented out due to needing a path name #-a always,exit -F arch=b32 -F path=path-to-db -F auid>=1000 -F auid!=unset -F uid!=daemon-acct -F perm=r -F key=10.2.1-cardholder-access #-a always,exit -F arch=b64 -F path=path-to-db -F auid>=1000 -F auid!=unset -F uid!=daemon-acct -F perm=r -F key=10.2.1-cardholder-access ## 10.2.2 Log administrative action. To meet this, you need to enable tty ## logging. The pam config below should be placed into su and sudo pam stacks. ## session required pam_tty_audit.so disable=* enable=root ## Special case for systemd-run. It is not audit aware, specifically watch it -a always,exit -F arch=b32 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation -a always,exit -F arch=b64 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation ## Special case for pkexec. It is not audit aware, specifically watch it -a always,exit -F arch=b32 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation -a always,exit -F arch=b64 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation ## Watch for configuration changes to privilege escalation. -a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key=10.2.2-priv-config-changes -a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=10.2.2-priv-config-changes -a always,exit -F arch=b32 -F dir=/etc/sudoers.d/ -F perm=wa -F key=10.2.2-priv-config-changes -a always,exit -F arch=b64 -F dir=/etc/sudoers.d/ -F perm=wa -F key=10.2.2-priv-config-changes ## 10.2.3 Access to all audit trails. -a always,exit -F arch=b32 -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=10.2.3-access-audit-trail -a always,exit -F arch=b64 -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=10.2.3-access-audit-trail -a always,exit -F arch=b32 -F path=/usr/sbin/ausearch -F perm=x -F key=10.2.3-access-audit-trail -a always,exit -F arch=b64 -F path=/usr/sbin/ausearch -F perm=x -F key=10.2.3-access-audit-trail -a always,exit -F arch=b32 -F path=/usr/sbin/aureport -F perm=x -F key=10.2.3-access-audit-trail -a always,exit -F arch=b64 -F path=/usr/sbin/aureport -F perm=x -F key=10.2.3-access-audit-trail -a always,exit -F arch=b32 -F path=/usr/sbin/aulast -F perm=x -F key=10.2.3-access-audit-trail -a always,exit -F arch=b64 -F path=/usr/sbin/aulast -F perm=x -F key=10.2.3-access-audit-trail -a always,exit -F arch=b32 -F path=/usr/sbin/aulastlog -F perm=x -F key=10.2.3-access-audit-trail -a always,exit -F arch=b64 -F path=/usr/sbin/aulastlog -F perm=x -F key=10.2.3-access-audit-trail ## 10.2.4 Invalid logical access attempts. This is naturally met by pam. You ## can find these events with: ausearch --start today -m user_login -sv no -i ## 10.2.5.a Use of I&A mechanisms is logged. Pam naturally handles this. ## you can find the events with: ## ausearch --start today -m user_auth,user_chauthtok -i ## 10.2.5.b All elevation of privileges is logged -a always,exit -F arch=b64 -S setuid -F a0=0 -F exe=/usr/bin/su -F key=10.2.5.b-elevated-privs-session -a always,exit -F arch=b32 -S setuid -F a0=0 -F exe=/usr/bin/su -F key=10.2.5.b-elevated-privs-session -a always,exit -F arch=b64 -S setresuid -F a0=0 -F exe=/usr/bin/sudo -F key=10.2.5.b-elevated-privs-session -a always,exit -F arch=b32 -S setresuid -F a0=0 -F exe=/usr/bin/sudo -F key=10.2.5.b-elevated-privs-session -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=10.2.5.b-elevated-privs-setuid -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -F key=10.2.5.b-elevated-privs-setuid ## 10.2.5.c All changes, additions, or deletions to any account are logged ## This is implicitly covered by shadow-utils. We will place some rules ## in case someone tries to hand edit the trusted databases -a always,exit -F arch=b32 -F path=/etc/group -F perm=wa -F key=10.2.5.c-accounts -a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F key=10.2.5.c-accounts -a always,exit -F arch=b32 -F path=/etc/passwd -F perm=wa -F key=10.2.5.c-accounts -a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F key=10.2.5.c-accounts -a always,exit -F arch=b32 -F path=/etc/gshadow -F perm=wa -F key=10.2.5.c-accounts -a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F key=10.2.5.c-accounts -a always,exit -F arch=b32 -F path=/etc/shadow -F perm=wa -F key=10.2.5.c-accounts -a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F key=10.2.5.c-accounts -a always,exit -F arch=b32 -F path=/etc/security/opasswd -F perm=wa -F key=10.2.5.c-accounts -a always,exit -F arch=b64 -F path=/etc/security/opasswd -F perm=wa -F key=10.2.5.c-accounts ## 10.2.6 Verify the following are logged: ## Initialization of audit logs ## Stopping or pausing of audit logs. ## These are handled implicitly by auditd ## 10.2.7 Creation and deletion of system-level objects ## This requirement seems to be database table related and not audit ## 10.3 Record at least the following audit trail entries ## 10.3.1 through 10.3.6 are implicitly met by the audit system. ## 10.4.2b Time data is protected. ## We will place rules to check time synchronization -a always,exit -F arch=b32 -S adjtimex,settimeofday,stime -F key=10.4.2b-time-change -a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=10.4.2b-time-change -a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=10.4.2b-time-change -a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=10.4.2b-time-change # Introduced in 2.6.39, commented out because it can make false positives #-a always,exit -F arch=b32 -S clock_adjtime -F key=10.4.2b-time-change #-a always,exit -F arch=b64 -S clock_adjtime -F key=10.4.2b-time-change -a always,exit -F arch=b32 -F path=/etc/localtime -F perm=wa -F key=10.4.2b-time-change -a always,exit -F arch=b64 -F path=/etc/localtime -F perm=wa -F key=10.4.2b-time-change ## 10.5 Secure audit trails so they cannot be altered ## The audit system protects audit logs by virtue of being the root user. ## That means that no normal user can tamper with the audit trail. If for ## some reason you suspect that admins may be malicious or that their acct ## could be compromised, then enable the remote logging plugin and get the ## logs off the system to assure that there is an unaltered copy. ## 10.5.1 Limit viewing of audit trails to those with a job-related need. ## The audit daemon by default limits viewing of the audit trail to root. ## If someone that is not an admin has a job related need to see logs, then ## create a unique group for people with this need and set the log_group ## configuration item in auditd.conf ## 10.5.2 Protect audit trail files from unauthorized modifications. ## See discussion in 10.5 above ## 10.5.3 Promptly back up audit trail files to a centralized log server ## See discussion in 10.5 above ## 10.5.4 Write logs for external-facing technologies onto a secure, ## centralized, internal log serve ## See discussion in 10.5 above ## 10.5.5 Use file-integrity monitoring or change-detection software on logs -a always,exit -F arch=b32 -F dir=/var/log/audit/ -F perm=wa -F key=10.5.5-modification-audit -a always,exit -F arch=b64 -F dir=/var/log/audit/ -F perm=wa -F key=10.5.5-modification-audit ## Feel free to add watches on other critical logs # -a always,exit -F arch=b32 -F path=path-to-log -F perm=wa -F key=10.5.5-modification-log # -a always,exit -F arch=b64 -F path=path-to-log -F perm=wa -F key=10.5.5-modification-log sample-rules/30-nispom.rules 0000644 00000011517 15125660163 0011770 0 ustar 00 ## This file contains a sample audit configuration intended to ## meet the NISPOM Chapter 8 rules. This rule depends on having ## 10-base-config.rules & 99-finalize.rules installed. ## Audit 1, 1(a) Enough information to determine the date and time of ## action (e.g., common network time), the system locale of the action, ## the system entity that initiated or completed the action, the resources ## involved, and the action involved. ## Things that could affect time -a always,exit -F arch=b32 -S adjtimex,settimeofday,stime -F key=time-change -a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=time-change -a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change -a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change # Introduced in 2.6.39, commented out because it can make false positives #-a always,exit -F arch=b32 -S clock_adjtime -F key=time-change #-a always,exit -F arch=b64 -S clock_adjtime -F key=time-change -w /etc/localtime -p wa -k time-change ## Things that could affect system locale -a always,exit -F arch=b32 -S sethostname,setdomainname -F key=system-locale -a always,exit -F arch=b64 -S sethostname,setdomainname -F key=system-locale -w /etc/issue -p wa -k system-locale -w /etc/issue.net -p wa -k system-locale -w /etc/hosts -p wa -k system-locale -w /etc/hostname -p wa -k system-locale -w /etc/sysconfig/network -p wa -k system-locale -a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -F key=system-locale ## Audit 1, 1(b) Successful and unsuccessful logons and logoffs. ## This is covered by patches to login, gdm, and openssh ## Might also want to watch these files if needing extra information #-w /var/log/tallylog -p wa -k logins #-w /var/run/faillock/ -p wa -k logins #-w /var/log/lastlog -p wa -k logins #-w /var/log/btmp -p wa -k logins #-w /var/run/utmp -p wa -k logins ## Audit 1, 1(c) Successful and unsuccessful accesses to ## security-relevant objects and directories, including ## creation, open, close, modification, and deletion. ## unsuccessful creation -a always,exit -F arch=b32 -S creat,link,mknod,mkdir,symlink,mknodat,linkat,symlinkat -F exit=-EACCES -F key=creation -a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -F key=creation -a always,exit -F arch=b32 -S link,mkdir,symlink,mkdirat -F exit=-EPERM -F key=creation -a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -F key=creation ## unsuccessful open -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F key=open -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F key=open -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F key=open -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F key=open ## unsuccessful close -a always,exit -F arch=b32 -S close -F exit=-EIO -F key=close -a always,exit -F arch=b64 -S close -F exit=-EIO -F key=close ## unsuccessful modifications -a always,exit -F arch=b32 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -F key=mods -a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -F key=mods -a always,exit -F arch=b32 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -F key=mods -a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -F key=mods ## unsuccessful deletion -a always,exit -F arch=b32 -S unlink,rmdir,unlinkat -F exit=-EACCES -F key=delete -a always,exit -F arch=b64 -S rmdir,unlink,unlinkat -F exit=-EACCES -F key=delete -a always,exit -F arch=b32 -S unlink,rmdir,unlinkat -F exit=-EPERM -F key=delete -a always,exit -F arch=b64 -S rmdir,unlink,unlinkat -F exit=-EPERM -F key=delete ## Audit 1, 1(d) Changes in user authenticators. ## Covered by patches to libpam, passwd, and shadow-utils ## Might also want to watch these files for changes -w /etc/group -p wa -k auth -w /etc/passwd -p wa -k auth -w /etc/gshadow -p wa -k auth -w /etc/shadow -p wa -k auth -w /etc/security/opasswd -p wa -k auth ## Audit 1, 1(e) The blocking or blacklisting of a user ID, ## terminal, or access port and the reason for the action. ## Covered by patches to pam_tally2 or pam_faillock and pam_limits ## Audit 1, 1(f) Denial of access resulting from an excessive ## number of unsuccessful logon attempts. ## Covered by patches to pam_tally2 or pam_faillock ## Audit 1, 2 Audit Trail Protection. The contents of audit trails ## shall be protected against unauthorized access, modification, ## or deletion. ## This should be covered by file permissions, but we can watch it ## to see any activity -w /var/log/audit/ -k audit-logs sample-rules/99-finalize.rules 0000644 00000000126 15125660163 0012275 0 ustar 00 ## Make the configuration immutable - reboot is required to change audit rules #-e 2 sample-rules/30-ospp-v42-6-owner-change-success.rules 0000644 00000000447 15125660163 0016241 0 ustar 00 ## Successful ownership change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change sample-rules/12-cont-fail.rules 0000644 00000000515 15125660163 0012333 0 ustar 00 ## This rule will cause auditctl to continue loading rules when it runs ## across an unsupported field or a rule with a syntax error however it will ## report an error at exit. The normal action is to report the line and ## issue with the rule and exit immediately with an error to get the admin's ## attention to fix the rules. -c sample-rules/11-loginuid.rules 0000644 00000000135 15125660163 0012266 0 ustar 00 ## Make the loginuid immutable. This prevents tampering with the auid. --loginuid-immutable sample-rules/30-ospp-v42-1-create-failed.rules 0000644 00000002734 15125660163 0014677 0 ustar 00 ## Unsuccessful file creation (open with O_CREAT) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create sample-rules/20-dont-audit.rules 0000644 00000001004 15125660163 0012520 0 ustar 00 ## This is for don't audit rules. We put these early because audit ### is a first match wins system. Uncomment the rules you want. ## Cron jobs fill the logs with stuff we normally don't want #-a never,user -F subj_type=crond_t ## This prevents chrony from overwhelming the logs #-a never,exit -F arch=x86_64 -S adjtimex -F auid=unset -F uid=chrony -F subj_type=chronyd_t ### This is not very interesting and wastes a lot of space if ### the server is public facing #-a always,exclude -F msgtype=CRYPTO_KEY_USER sample-rules/30-ospp-v42-1-create-success.rules 0000644 00000001352 15125660163 0015116 0 ustar 00 ## Successful file creation (open with O_CREAT) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b32 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b32 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create -a always,exit -F arch=b64 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create sample-rules/30-ospp-v42-5-perm-change-success.rules 0000644 00000000636 15125660163 0016051 0 ustar 00 ## Successful permission change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change sample-rules/71-networking.rules 0000644 00000000227 15125660163 0012653 0 ustar 00 ## This is to check if the system is making or receiving connections ## externally -a always,exit -F arch=b64 -S accept,connect -F key=external-access sample-rules/40-local.rules 0000644 00000000264 15125660163 0011553 0 ustar 00 ## Put your own watches after this point # -a exit,always -F arch=b64 -F path=file -F perm=rwxa -F key=text # -a exit,always -F arch=b64 -F dir=directory -F perm=rwxa -F key=text sample-rules/30-ospp-v42-5-perm-change-failed.rules 0000644 00000001460 15125660163 0015621 0 ustar 00 ## Unsuccessful permission change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change sample-rules/22-ignore-chrony.rules 0000644 00000000376 15125660163 0013250 0 ustar 00 ## This rule suppresses the time-change event when chrony does time updates -a never,exit -F arch=b64 -S adjtimex -F auid=unset -F uid=chrony -F subj_type=chronyd_t -a never,exit -F arch=b32 -S adjtimex -F auid=unset -F uid=chrony -F subj_type=chronyd_t sample-rules/44-installers.rules 0000644 00000002360 15125660163 0012644 0 ustar 00 # These rules watch for invocation of things known to install software -a always,exit -F arch=b32 -F perm=x -F path=/usr/bin/dnf-3 -F key=software-installer -a always,exit -F arch=b64 -F perm=x -F path=/usr/bin/dnf-3 -F key=software-installer -a always,exit -F arch=b32 -F perm=x -F path=/usr/bin/yum -F key=software-installer -a always,exit -F arch=b64 -F perm=x -F path=/usr/bin/yum -F key=software-installer -a always,exit -F arch=b32 -F perm=x -F path=/usr/bin/pip -F key=software-installer -a always,exit -F arch=b64 -F perm=x -F path=/usr/bin/pip -F key=software-installer -a always,exit -F arch=b32 -F perm=x -F path=/usr/bin/npm -F key=software-installer -a always,exit -F arch=b64 -F perm=x -F path=/usr/bin/npm -F key=software-installer -a always,exit -F arch=b32 -F perm=x -F path=/usr/bin/cpan -F key=software-installer -a always,exit -F arch=b64 -F perm=x -F path=/usr/bin/cpan -F key=software-installer -a always,exit -F arch=b32 -F perm=x -F path=/usr/bin/gem -F key=software-installer -a always,exit -F arch=b64 -F perm=x -F path=/usr/bin/gem -F key=software-installer -a always,exit -F arch=b32 -F perm=x -F path=/usr/bin/luarocks -F key=software-installer -a always,exit -F arch=b64 -F perm=x -F path=/usr/bin/luarocks -F key=software-installer sample-rules/21-no32bit.rules 0000644 00000000421 15125660163 0011733 0 ustar 00 ## If you are on a 64 bit platform, everything _should_ be running ## in 64 bit mode. This rule will detect any use of the 32 bit syscalls ## because this might be a sign of someone exploiting a hole in the 32 ## bit API. -a always,exit -F arch=b32 -S all -F key=32bit-abi sample-rules/30-ospp-v42-3-access-failed.rules 0000644 00000001161 15125660163 0014670 0 ustar 00 ## Unsuccessful file access (any other opens) This has to go last. -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access sample-rules/30-ospp-v42-2-modify-success.rules 0000644 00000001472 15125660163 0015146 0 ustar 00 ## Successful file modifications (open for write or truncate) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification sample-rules/23-ignore-filesystems.rules 0000644 00000000773 15125660163 0014317 0 ustar 00 # This rule suppresses events that originate on the below file systems. # Typically you would use this in conjunction with rules to monitor # kernel modules. The filesystem listed are known to cause hundreds of # path records during kernel module load. As an aside, if you do see the # tracefs or debugfs module load and this is a production system, you really # should look into why its getting loaded and prevent it if possible. -a never,filesystem -F fstype=tracefs -a never,filesystem -F fstype=debugfs sample-rules/30-ospp-v42.rules 0000644 00000022145 15125660163 0012054 0 ustar 00 ## The purpose of these rules is to meet the requirements for Operating ## System Protection Profile (OSPP)v4.2. These rules depends on having ## the following rule files copied to /etc/audit/rules.d: ## ## 10-base-config.rules, 11-loginuid.rules, ## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules, ## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules, ## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules, ## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules, ## 30-ospp-v42-5-perm-change-failed.rules, ## 30-ospp-v42-5-perm-change-success.rules, ## 30-ospp-v42-6-owner-change-failed.rules, ## 30-ospp-v42-6-owner-change-success.rules ## ## original copies may be found in /usr/share/audit/sample-rules/ ## User add delete modify. This is covered by pam. However, someone could ## open a file and directly create or modify a user, so we'll watch passwd and ## shadow for writes -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify ## User enable and disable. This is entirely handled by pam. ## Group add delete modify. This is covered by pam. However, someone could ## open a file and directly create or modify a user, so we'll watch group and ## gshadow for writes -a always,exit -F arch=b32 -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F arch=b32 -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify ## Use of special rights for config changes. This would be use of setuid ## programs that relate to user accts. This is not all setuid apps because ## requirements are only for ones that affect system configuration. -a always,exit -F arch=b32 -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b32 -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes -a always,exit -F arch=b64 -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes ## Privilege escalation via su or sudo. This is entirely handled by pam. ## Special case for systemd-run. It is not audit aware, specifically watch it -a always,exit -F arch=b32 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation -a always,exit -F arch=b64 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation ## Special case for pkexec. It is not audit aware, specifically watch it -a always,exit -F arch=b32 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation -a always,exit -F arch=b64 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation ## Watch for configuration changes to privilege escalation. -a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key=special-config-changes -a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=special-config-changes -a always,exit -F arch=b32 -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes -a always,exit -F arch=b64 -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes ## Audit log access -a always,exit -F arch=b32 -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail -a always,exit -F arch=b64 -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail ## Attempts to Alter Process and Session Initiation Information -a always,exit -F arch=b32 -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F arch=b64 -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F arch=b32 -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F arch=b64 -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F arch=b32 -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session -a always,exit -F arch=b64 -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session ## Attempts to modify MAC controls -a always,exit -F arch=b32 -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy -a always,exit -F arch=b64 -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy ## Software updates. This is entirely handled by rpm. ## System start and shutdown. This is entirely handled by systemd ## Kernel Module loading. This is handled in 43-module-load.rules ## Application invocation. The requirements list an optional requirement ## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to ## state results from that policy. This would be handled entirely by ## that daemon. sample-rules/10-no-audit.rules 0000644 00000000434 15125660163 0012175 0 ustar 00 ## This set of rules is to suppress the performance effects of the ## audit system. The result is that you only get hardwired events. -D ## This suppresses syscall auditing for all tasks started ## with this rule in effect. Remove it if you need syscall ## auditing. -a task,never sample-rules/30-ospp-v42-2-modify-failed.rules 0000644 00000003156 15125660163 0014723 0 ustar 00 ## Unsuccessful file modifications (open for write or truncate) -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification sample-rules/30-ospp-v42-4-delete-success.rules 0000644 00000000434 15125660163 0015120 0 ustar 00 ## Successful file delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete sample-rules/30-ospp-v42-3-access-success.rules 0000644 00000000617 15125660163 0015121 0 ustar 00 ## Successful file access (any other opens) This has to go last. ## These next two are likely to result in a whole lot of events -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access sample-rules/30-ospp-v42-4-delete-failed.rules 0000644 00000001062 15125660163 0014672 0 ustar 00 ## Unsuccessful file delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete sample-rules/70-einval.rules 0000644 00000000506 15125660163 0011741 0 ustar 00 ## These are rules are to locate poorly written programs. ## Its never planned to waste time on a syscall with incorrect parameters ## This is more of a debugging step than something people should run with ## in production. -a never,exit -F arch=b64 -S rt_sigreturn -a always,exit -S all -F exit=-EINVAL -F key=einval-retcode sample-rules/43-module-load.rules 0000644 00000000616 15125660163 0012667 0 ustar 00 ## These rules watch for kernel module insertion. By monitoring ## the syscall, we do not need any watches on programs. -a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load -a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load -a always,exit -F arch=b32 -S delete_module -F key=module-unload -a always,exit -F arch=b64 -S delete_module -F key=module-unload sample-rules/30-stig.rules 0000644 00000022401 15125660163 0011423 0 ustar 00 ## The purpose of these rules is to meet the stig auditing requirements ## These rules depends on having 10-base-config.rules & 99-finalize.rules ## installed. ## NOTE: ## 1) if this is being used on a 32 bit machine, comment out the b64 lines ## 2) These rules assume that login under the root account is not allowed. ## 3) It is also assumed that 1000 represents the first usable user account. To ## be sure, look at UID_MIN in /etc/login.defs. ## 4) If these rules generate too much spurious data for your tastes, limit the ## syscall file rules with a directory, like -F dir=/etc ## 5) You can search for the results on the key fields in the rules ## ## ## (GEN002880: CAT II) The IAO will ensure the auditing software can ## record the following for each audit event: ##- Date and time of the event ##- Userid that initiated the event ##- Type of event ##- Success or failure of the event ##- For I&A events, the origin of the request (e.g., terminal ID) ##- For events that introduce an object into a user’s address space, and ## for object deletion events, the name of the object, and in MLS ## systems, the object’s security level. ## ## Things that could affect time -a always,exit -F arch=b32 -S adjtimex,settimeofday,stime -F key=time-change -a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=time-change -a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change -a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change # Introduced in 2.6.39, commented out because it can make false positives #-a always,exit -F arch=b32 -S clock_adjtime -F key=time-change #-a always,exit -F arch=b64 -S clock_adjtime -F key=time-change -a always,exit -F arch=b32 -F path=/etc/localtime -F perm=wa -F key=time-change -a always,exit -F arch=b64 -F path=/etc/localtime -F perm=wa -F key=time-change ## Things that affect identity -a always,exit -F arch=b32 -F path=/etc/group -F perm=wa -F key=identity -a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F key=identity -a always,exit -F arch=b32 -F path=/etc/passwd -F perm=wa -F key=identity -a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F key=identity -a always,exit -F arch=b32 -F path=/etc/gshadow -F perm=wa -F key=identity -a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F key=identity -a always,exit -F arch=b32 -F path=/etc/shadow -F perm=wa -F key=identity -a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F key=identity -a always,exit -F arch=b32 -F path=/etc/security/opasswd -F perm=wa -F key=identity -a always,exit -F arch=b64 -F path=/etc/security/opasswd -F perm=wa -F key=identity ## Things that could affect system locale -a always,exit -F arch=b32 -S sethostname,setdomainname -F key=system-locale -a always,exit -F arch=b64 -S sethostname,setdomainname -F key=system-locale -a always,exit -F arch=b32 -F path=/etc/issue -F perm=wa -F key=system-locale -a always,exit -F arch=b64 -F path=/etc/issue -F perm=wa -F key=system-locale -a always,exit -F arch=b32 -F path=/etc/issue.net -F perm=wa -F key=system-locale -a always,exit -F arch=b64 -F path=/etc/issue.net -F perm=wa -F key=system-locale -a always,exit -F arch=b32 -F path=/etc/hosts -F perm=wa -F key=system-locale -a always,exit -F arch=b64 -F path=/etc/hosts -F perm=wa -F key=system-locale -a always,exit -F arch=b32 -F path=/etc/hostname -F perm=wa -F key=system-locale -a always,exit -F arch=b64 -F path=/etc/hostname -F perm=wa -F key=system-locale -a always,exit -F arch=b32 -F dir=/etc/NetworkManager/ -F perm=wa -F key=system-locale -a always,exit -F arch=b64 -F dir=/etc/NetworkManager/ -F perm=wa -F key=system-locale ## Things that could affect MAC policy -a always,exit -F arch=b32 -F dir=/etc/selinux/ -F perm=wa -F key=MAC-policy -a always,exit -F arch=b64 -F dir=/etc/selinux/ -F perm=wa -F key=MAC-policy ## (GEN002900: CAT III) The IAO will ensure audit files are retained at ## least one year; systems containing SAMI will be retained for five years. ## ## Site action - no action in config files ## (GEN002920: CAT III) The IAO will ensure audit files are backed up ## no less than weekly onto a different system than the system being ## audited or backup media. ## ## Can be done with cron script ## (GEN002700: CAT I) (Previously – G095) The SA will ensure audit data ## files have permissions of 640, or more restrictive. ## ## Done automatically by auditd ## (GEN002720-GEN002840: CAT II) (Previously – G100-G106) The SA will ## configure the auditing system to audit the following events for all ## users and root: ## ## - Logon (unsuccessful and successful) and logout (successful) ## ## Handled by pam, sshd, login, and gdm ## Might also want to watch these files if needing extra information #-a always,exit -F arch=b32 -F path=/var/log/tallylog -F perm=wa -F key=logins #-a always,exit -F arch=b64 -F path=/var/log/tallylog -F perm=wa -F key=logins #-a always,exit -F arch=b32 -F path=/var/run/faillock -F perm=wa -F key=logins #-a always,exit -F arch=b64 -F path=/var/run/faillock -F perm=wa -F key=logins #-a always,exit -F arch=b32 -F path=/var/log/lastlog -F perm=wa -F key=logins #-a always,exit -F arch=b64 -F path=/var/log/lastlog -F perm=wa -F key=logins ##- Process and session initiation (unsuccessful and successful) ## ## The session initiation is audited by pam without any rules needed. ## Might also want to watch this file if needing extra information #-a always,exit -F arch=b32 -F path=/var/run/utmp -F perm=wa -F key=session #-a always,exit -F arch=b64 -F path=/var/run/utmp -F perm=wa -F key=session #-a always,exit -F arch=b32 -F path=/var/log/btmp -F perm=wa -F key=session #-a always,exit -F arch=b64 -F path=/var/log/btmp -F perm=wa -F key=session #-a always,exit -F arch=b32 -F path=/var/log/wtmp -F perm=wa -F key=session #-a always,exit -F arch=b64 -F path=/var/log/wtmp -F perm=wa -F key=session ##- Discretionary access control permission modification (unsuccessful ## and successful use of chown/chmod) -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod -a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod ##- Unauthorized access attempts to files (unsuccessful) -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access ##- Use of print command (unsuccessful and successful) ##- Export to media (successful) ## You have to mount media before using it. You must disable all automounting ## so that its done manually in order to get the correct user requesting the ## export -a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -F key=export -a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -F key=export ##- System startup and shutdown (unsuccessful and successful) ##- Files and programs deleted by the user (successful and unsuccessful) -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=unset -F key=delete -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=unset -F key=delete ##- All system administration actions ##- All security personnel actions ## ## Look for pam_tty_audit and add it to your login entry point's pam configs. ## If that is not found, use sudo which should be patched to record its ## commands to the audit system. Do not allow unrestricted root shells or ## sudo cannot record the action. -a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key=actions -a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=actions -a always,exit -F arch=b32 -F dir=/etc/sudoers.d/ -F perm=wa -F key=actions -a always,exit -F arch=b64 -F dir=/etc/sudoers.d/ -F perm=wa -F key=actions ## Special case for systemd-run. It is not audit aware, specifically watch it -a always,exit -F arch=b32 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation -a always,exit -F arch=b64 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation ## Special case for pkexec. It is not audit aware, specifically watch it -a always,exit -F arch=b32 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation -a always,exit -F arch=b64 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation ## (GEN002860: CAT II) (Previously – G674) The SA and/or IAO will ##ensure old audit logs are closed and new audit logs are started daily. ## ## Site action. Can be assisted by a cron job sample-rules/42-injection.rules 0000644 00000001240 15125660163 0012440 0 ustar 00 ## These rules watch for code injection by the ptrace facility. ## This could indicate someone trying to do something bad or ## just debugging #-a always,exit -F arch=b32 -S ptrace -F key=tracing -a always,exit -F arch=b64 -S ptrace -F key=tracing -a always,exit -F arch=b32 -S ptrace -F a0=0x4 -F key=code-injection -a always,exit -F arch=b64 -S ptrace -F a0=0x4 -F key=code-injection -a always,exit -F arch=b32 -S ptrace -F a0=0x5 -F key=data-injection -a always,exit -F arch=b64 -S ptrace -F a0=0x5 -F key=data-injection -a always,exit -F arch=b32 -S ptrace -F a0=0x6 -F key=register-injection -a always,exit -F arch=b64 -S ptrace -F a0=0x6 -F key=register-injection sample-rules/30-ospp-v42-6-owner-change-failed.rules 0000644 00000001103 15125660163 0016003 0 ustar 00 ## Unsuccessful ownership change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change sample-rules/12-ignore-error.rules 0000644 00000000507 15125660163 0013072 0 ustar 00 ## This rule will cause auditctl to continue loading rules when it runs ## across an unsupported field or a rule with a syntax error but exit with ## success reason code. The normal action is to report the line and issue with ## the rule and exit immediately with an error to get the admin's attention to ## fix the rules. -i sample-rules/10-base-config.rules 0000644 00000000364 15125660163 0012634 0 ustar 00 ## First rule - delete all -D ## Increase the buffers to survive stress events. ## Make this bigger for busy systems -b 8192 ## This determine how long to wait in burst of events --backlog_wait_time 60000 ## Set failure mode to syslog -f 1 sample-rules/31-privileged.rules 0000644 00000003077 15125660163 0012620 0 ustar 00 ##- Use of privileged commands (unsuccessful and successful) ## You can run the following commands to generate the rules (don't forget to ## add arch=b32 rules, too): #find /bin -type f -perm -04000 2>/dev/null | awk '{ printf "-a always,exit -F arch=b64 -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $1 }' > priv.rules #find /sbin -type f -perm -04000 2>/dev/null | awk '{ printf "-a always,exit -F arch=b64 -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $1 }' >> priv.rules #find /usr/bin -type f -perm -04000 2>/dev/null | awk '{ printf "-a always,exit -F arch=b64 -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $1 }' >> priv.rules #find /usr/sbin -type f -perm -04000 2>/dev/null | awk '{ printf "-a always,exit -F arch=b64 -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $1 }' >> priv.rules #filecap /bin 2>/dev/null | sed '1d' | awk '{ printf "-a always,exit -F path=%s -F arch=b64 -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $2 }' >> priv.rules #filecap /sbin 2>/dev/null | sed '1d' | awk '{ printf "-a always,exit -F path=%s -F arch=b64 -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $2 }' >> priv.rules #filecap /usr/bin 2>/dev/null | sed '1d' | awk '{ printf "-a always,exit -F arch=b64 -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $2 }' >> priv.rules #filecap /usr/sbin 2>/dev/null | sed '1d' | awk '{ printf "-a always,exit -F arch=b64 -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $2 }' >> priv.rules sample-rules/32-power-abuse.rules 0000644 00000000325 15125660163 0012711 0 ustar 00 ## The purpose of this rule is to detect when an admin may be abusing power ## by looking in user's home dir. -a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=unset -C auid!=obj_uid -F key=power-abuse auditd.cron 0000644 00000000512 15125705615 0006706 0 ustar 00 #!/bin/sh ########## # This script can be installed to the cron system to get log rotation # based on time instead of log size. ########## /sbin/auditctl --signal usr1 EXITVALUE=$? if [ $EXITVALUE != 0 ]; then /usr/bin/logger -t auditd "ALERT auditctl exited abnormally with [$EXITVALUE] while rotating the logs" fi exit 0 README 0000644 00000011530 15125705615 0005433 0 ustar 00 This is some background information about the Linux Auditing Framework. LICENSE ======= The audit daemon is released as GPL'd code. The audit daemon's libraries libaudit.* and libauparse.* are released under LGPL so that it may be linked with 3rd party software. BUILDING ======== See the Install(.tmp) file. USAGE ===== See the man pages for audit, auditctl, audit.rules, ausearch, and aureport. DISCUSSION ========== Original lkml thread(s): https://marc.info/?t=107815888100001&r=1&w=2 https://marc.info/?t=107901570800002&r=1&w=2 There is a linux audit mail list where any question whether kernel design, setup and configuration, or usage can be discussed: http://www.redhat.com/mailman/listinfo/linux-audit DESIGN INFO (Very old) ===================== The main goals were to provide system call auditing with 1) as low overhead as possible, and 2) without duplicating functionality that is already provided by SELinux (and/or other security infrastructures). This framework will work "stand-alone", but is not designed to provide, e.g., CAPP functionality without another security component in place. There are two main parts, one that is always on (generic logging in audit.c) and one that you can disable at boot- or run-time (per-system-call auditing in auditsc.c). The patch includes changes to security/selinux/avc.c as an example of how system-call auditing can be integrated with other code that identifies auditable events. Logging: 1) Uses a netlink socket for communication with user-space. All messages are logged via the netlink socket if a user-space daemon is listening. If not, the messages are logged via printk to the syslog daemon (by default). 2) Messages can be dropped (optionally) based on message rate or memory use (this isn't fully integrated into the selinux/avc.c part of the patch: the avc.c code that currently does this can be eliminated). 3) When some part of the kernel generates part of an audit record, the partial record is sent immediately to user-space, AND the system call "auditable" flag is automatically set for that call -- thereby producing extra information at syscall exit (if syscall auditing is enabled). System-call auditing: 1) At task-creation time, an audit context is allocated and linked off the task structure. 2) At syscall entry time, if the audit context exists, information is filled in (syscall number, timestamp; but not arguments). 3) During the system call, calls to getname() and path_lookup() are intercepted. These routines are called when the kernel is actually looking up information that will be used to make the decision about whether the syscall will succeed or fail. An effort has been made to avoid copying the information that getname generates, since getname is already making a kernel-private copy of the information. [Note that storing copies of all syscall arguments requires complexity and overhead that arguably isn't needed. With this patch, for example, if chroot("foo") fails because you are not root, "foo" will not appear in the audit record because the kernel determined the syscall cannot proceed before it ever needed to look up "foo". This approach avoids storing user-supplied information that could be misleading or unreliable (e.g., due to a cooperative shared-memory attack) in favor of reporting information actually used by the kernel.] 4) At syscall exit time, if the "auditable" flag has been set (e.g., because SELinux generated an avc record; or some other part of the kernel detected an auditable event), the syscall-part of the audit record is generated, including file names and inode numbers (if available). Some of this information is currently complementary to the information that selinux/avc.c generates (e.g., file names and some inode numbers), but some is less complete (e.g., getname doesn't return a fully-qualified path, and this patch does not add the overhead of determining one). [Note that the complete audit record comes to userspace in pieces, which eliminates the need to store messages for arbitrarily long periods inside the kernel.] 5) At task-exit time, the audit context is destroyed. At steps 1, 2, and 4, simple filtering can be done (e.g., a database role uid might have syscall auditing disabled for performance reasons). The filtering is simple and could be made more complex. However, I tried to implement as much filtering as possible without adding significant overhead (e.g., d_path()). In general, the audit framework should rely on some other kernel component (e.g., SELinux) to make the majority of the decisions about what is and is not auditable. ChangeLog 0000644 00000033455 15125705615 0006337 0 ustar 00 See the git log for the complete list of changes. This is no longer maintained. 3.1.3 - Update TRUSTED_APP interpretation to look for known fields - In auditd plugins, allow variable amount of arguments (Attila Lakatos) - Speed up aureport --summary reports - Rewrite legacy service functions in terms of systemctl - Add a metrics function for auparse - Change auditctl to use pidfd_send_signal for signaling auditd 3.1.2 - When processing a run level change, make auditd exit - In auditd, fix return code when rules added in immutable mode - In auparse, when files are given, also consider EUID for access - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya) - Disable Python bindings from setting rules due to swig bug (S. Trofimovich) - Update all lookup tables for the 6.5 kernel - Don't be as paranoid about auditctl -R file permissions - In ausearch, correct subject/object search to be an and if both are given - Adjust formats for 64 bit time_t - Fix segfault in python bindings around the feed API - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings 3.1.1 - Add user friendly keywords for signals to auditctl - In ausearch, parse up URINGOP and DM_CTRL records - Harden auparse to better handle corrupt logs - Fix a CFLAGS propogation problem in the common directory - Move the audispd af_unix plugin to a standalone program 3.1 - Disable ProtectControlGroups in auditd.service by default - Fix rule checking for exclude filter - Make audit_rule_syscallbyname_data work correctly outside of auditctl - Add new record types - Add io_uring support - Add support for new FANOTIFY record fields - Add keyword, this-hour, to ausearch/report start/end options - Add Requires.private to audit.pc file - Try to interpret OPENAT2 fields correctly 3.0.9 - In auditd, release the async flush lock on stop - Don't allow auditd to log directly into /var/log when log_group is non-zero - Cleanup krb5 memory leaks on error paths - Update auditd.cron to use auditctl --signal - In auparse, if too many fields, realloc array bigger (Paul Wolneykien) - In auparse, special case kernel module name interpretation - If overflow_action is ignore, don't treat as an error 3.0.8 - Add gcc function attributes for access and allocation - Add some more man pages (MIZUTA Takeshi) - In auditd, change the reinitializing of the plugin queue - Fix path normalization in auparse (Sergio Correia) - In libaudit, handle ECONNREFUSED for network uid/gid lookups (Enzo Matsumiya) - In audisp-remote, fix hang with disk_low_action=suspend (Enzo Matsumiya) - Drop ProtectHome from auditd.service as it interferes with rules 3.0.7 - Add support for the OPENAT2 record type (Richard Guy Briggs) - In auditd, close the logging file descriptor when logging is suspended - Update the capabilities lookup table to match 5.16 kernel - Improve interpretation of renamat & faccessat family of syscalls - Update syscall table for the 5.16 kernel - Reduce dependency from initscripts to initscripts-service 3.0.6 - Fixed various issues when dealing with corrupted logs - Make IPX packet interpretation dependent on the ipx header file existing - Add b32/b64 support to ausyscall (Egor Ignatov) - Add support for armv8l (Egor Ignatov) - Fix auditctl list of syscalls in PPC (Egor Ignatov) - auditd.service now restarts auditd under some conditions (Timothée Ravier) 3.0.5 - In auditd, flush uid/gid caches when user/group added/deleted/modified - Fixed various issues when dealing with corrupted logs - In auditd, check if log_file is valid before closing handle 3.0.4 - Apply performance speedups to auparse library - Optimize rule loading in auditctl - Fix an auparse memory leak caused by glibc-2.33 by replacing realpath - Update syscall table to the 5.14 kernel - Fixed various issues when dealing with corrupted logs 3.0.3 - Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined - Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids - Change auparse_feed_has_data in auparse to include incomplete events - Auditd, stop linking against -lrt - Add ProtectHome and RestrictRealtime to auditd.service - In auditd, read up to 3 netlink packets in a row - In auditd, do not validate path to plugin unless active - In auparse, only emit config errors when AUPARSE_DEBUG env variable exists 3.0.2 - In audispd-statsd plugin, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpoint if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitute functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DAEMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearing in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd 2.8.3 - Correct msg function name in LRU debug code - Fix a segfault in auditd when dns resolution isn't available - Make a reload legacy service for auditd - In auparse python bindings, expose some new types that were missing - In normalizer, pickup subject kind for user_login events - Fix interpretation of unknown ioctcmds (#1540507) - Add ANOM_LOGIN_SERVICE, RESP_ORIGIN_BLOCK, & RESP_ORIGIN_BLOCK_TIMED events - In auparse_normalize for USER_LOGIN events, map acct for subj_kind - Fix logging of IPv6 addresses in DAEMON_ACCEPT events (#1534748) - Do not rotate auditd logs when num_logs < 2 (brozs) 2.8.2 - Update tables for 4.14 kernel - Fixup ipv6 server side binding - AVC report from aureport was missing result column header (#1511606) - Add SOFTWARE_UPDATE event - In ausearch/report pickup any path and new-disk fields as a file - Fix value returned by auditctl --reset-lost (Richard Guy Briggs) - In auparse, fix expr_create_timestamp_comparison_ex to be numeric field - Fix building on old systems without linux/fanotify.h - Fix shell portability issues reported by shellcheck - Auditd validate_email should not use gethostbyname 2.8.1 - Fix NULL ptr dereference in audispd plugin_dir parser - Signed/unsigned cleanup 2.8 - Add support for ambient capability fields (Richard Guy Briggs) - Update auparse-normalizer to support TTY events - Add auparse_normalize_object_primary2 API - In ausearch text format, add 'to xxx' for mount operations - In ausearch add new --extra-obj2 option for CSV output - In auparse_normalize, pick up second file name for rename syscalls - In auparse_normalize, pick up permission & ownership changes as obj2 - In auparse_normalize, pick up uid/gid for setuid/gid syscalls as obj2 - In auparse_normalize, pick up link for symlink syscalls as obj2 - In auparse_normalize, correct mount records based on success - In auparse_normalize, correct object for USER_MGMT, ACCT_LOCK, & ACCT_UNLOCK - Add default port to auditd.conf (#1455598) - Fix auvirt to report AVC's (#982154) - Add sockaddr accessor functions in auparse - In ausearch, use auparse_interpret_sock_address for text mode output - In remote logging, inform client auditd is suspended and please disconnect - Auditd and audisp-remote now supports IPv6 - In auparse function auparse_goto_record_num, make it positioned on first field - In auparse_normalize, finish support for MAC_STATUS and MAC_CONFIG events - Add support for filesystem filter type (Richard Guy Briggs) - Add file system type table for fstype lookup - Add command line option to auditd & audispd for config dir path (Dan Born) - Fix auparse serial parsing of event when system time < 9 characters (kruvin) - In auparse, allow non-equality comparisons for uid & gid fields (#1399314) - In auparse_normalize, add support for USER_DEVICE events - In audispd.conf, add new plugin_dir config item to customize plugin location - Add support for FANOTIFY event - Improve auparse_normalize support for SECCOMP events - In auparse_normalize, pick up comm for successful memory allocations <see audit-2.8.3 and later for full 2.X change history> <see audit-1.8 and later for 1.X change history> <see audit-1.0.12 for 1.0 change history>
| ver. 1.6 |
Github
|
.
| PHP 8.2.30 | ??????????? ?????????: 0 |
proxy
|
phpinfo
|
???????????