Blame SOURCES/scap-security-guide-0.1.41-audit_privileged_commands.patch

7629ac
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_seunshare.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_seunshare.rule
7629ac
new file mode 100644
7629ac
index 0000000000..ce7a936545
7629ac
--- /dev/null
7629ac
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_seunshare.rule
7629ac
@@ -0,0 +1,40 @@
7629ac
+documentation_complete: true
7629ac
+
7629ac
+prodtype: rhel7,fedora
7629ac
+
7629ac
+title: 'Record Any Attempts to Run seunshare'
7629ac
+
7629ac
+description: |-
7629ac
+    At a minimum, the audit system should collect any execution attempt
7629ac
+    of the <tt>seunshare</tt> command for all users and root. If the <tt>auditd</tt>
7629ac
+    daemon is configured to use the <tt>augenrules</tt> program to read audit rules
7629ac
+    during daemon startup (the default), add the following lines to a file with suffix
7629ac
+    <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
7629ac
+    
-a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
7629ac
+    utility to read audit rules during daemon startup, add the following lines to
7629ac
+    <tt>/etc/audit/audit.rules</tt> file:
7629ac
+    
-a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change
7629ac
+
7629ac
+rationale: |-
7629ac
+    Misuse of privileged functions, either intentionally or unintentionally by
7629ac
+    authorized users, or by unauthorized external entities that have compromised system accounts,
7629ac
+    is a serious and ongoing concern and can have significant adverse impacts on organizations.
7629ac
+    Auditing the use of privileged functions is one way to detect such misuse and identify
7629ac
+    the risk from insider and advanced persistent threast.
7629ac
+    

7629ac
+    Privileged programs are subject to escalation-of-privilege attacks,
7629ac
+    which attempt to subvert their normal role of providing some necessary but
7629ac
+    limited capability. As such, motivation exists to monitor these programs for
7629ac
+    unusual activity.
7629ac
+
7629ac
+severity: medium
7629ac
+
7629ac
+references:
7629ac
+    ospp@rhel7: FAU_GEN.1.1.c
7629ac
+
7629ac
+ocil: |-
7629ac
+    To verify that execution of the command is being audited, run the following command:
7629ac
+    
$ sudo grep "path=/usr/sbin/seunshare" /etc/audit/audit.rules /etc/audit/rules.d/*
7629ac
+    The output should return something similar to:
7629ac
+    
-a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change
7629ac
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_at.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_at.rule
7629ac
new file mode 100644
7629ac
index 0000000000..6d1a5c909b
7629ac
--- /dev/null
7629ac
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_at.rule
7629ac
@@ -0,0 +1,42 @@
7629ac
+documentation_complete: true
7629ac
+
7629ac
+prodtype: rhel7,fedora
7629ac
+
7629ac
+title: 'Ensure auditd Collects Information on the Use of Privileged Commands - at'
7629ac
+
7629ac
+description: |-
7629ac
+    At a minimum, the audit system should collect the execution of
7629ac
+    privileged commands for all users and root. If the <tt>auditd</tt> daemon is
7629ac
+    configured to use the <tt>augenrules</tt> program to read audit rules during
7629ac
+    daemon startup (the default), add a line of the following form to a file with
7629ac
+    suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
7629ac
+    
-a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
7629ac
+    utility to read audit rules during daemon startup, add a line of the following
7629ac
+    form to <tt>/etc/audit/audit.rules</tt>:
7629ac
+    
-a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
7629ac
+
7629ac
+rationale: |-
7629ac
+    Misuse of privileged functions, either intentionally or unintentionally by
7629ac
+    authorized users, or by unauthorized external entities that have compromised system accounts,
7629ac
+    is a serious and ongoing concern and can have significant adverse impacts on organizations.
7629ac
+    Auditing the use of privileged functions is one way to detect such misuse and identify
7629ac
+    the risk from insider and advanced persistent threast.
7629ac
+    

7629ac
+    Privileged programs are subject to escalation-of-privilege attacks,
7629ac
+    which attempt to subvert their normal role of providing some necessary but
7629ac
+    limited capability. As such, motivation exists to monitor these programs for
7629ac
+    unusual activity.
7629ac
+
7629ac
+severity: medium
7629ac
+
7629ac
+references:
7629ac
+    ospp@rhel7: FAU_GEN.1.1.c
7629ac
+
7629ac
+ocil_clause: 'it is not the case'
7629ac
+
7629ac
+ocil: |-
7629ac
+    To verify that auditing of privileged command use is configured, run the
7629ac
+    following command:
7629ac
+    
$ sudo grep '\bat\b' /etc/audit/audit.rules /etc/audit/rules.d/*
7629ac
+    It should return a relevant line in the audit rules.
7629ac
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount.rule
7629ac
new file mode 100644
7629ac
index 0000000000..8eb3f39f01
7629ac
--- /dev/null
7629ac
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount.rule
7629ac
@@ -0,0 +1,42 @@
7629ac
+documentation_complete: true
7629ac
+
7629ac
+prodtype: rhel7,fedora
7629ac
+
7629ac
+title: 'Ensure auditd Collects Information on the Use of Privileged Commands - mount'
7629ac
+
7629ac
+description: |-
7629ac
+    At a minimum, the audit system should collect the execution of
7629ac
+    privileged commands for all users and root. If the <tt>auditd</tt> daemon is
7629ac
+    configured to use the <tt>augenrules</tt> program to read audit rules during
7629ac
+    daemon startup (the default), add a line of the following form to a file with
7629ac
+    suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
7629ac
+    
-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
7629ac
+    utility to read audit rules during daemon startup, add a line of the following
7629ac
+    form to <tt>/etc/audit/audit.rules</tt>:
7629ac
+    
-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
7629ac
+
7629ac
+rationale: |-
7629ac
+    Misuse of privileged functions, either intentionally or unintentionally by
7629ac
+    authorized users, or by unauthorized external entities that have compromised system accounts,
7629ac
+    is a serious and ongoing concern and can have significant adverse impacts on organizations.
7629ac
+    Auditing the use of privileged functions is one way to detect such misuse and identify
7629ac
+    the risk from insider and advanced persistent threast.
7629ac
+    

7629ac
+    Privileged programs are subject to escalation-of-privilege attacks,
7629ac
+    which attempt to subvert their normal role of providing some necessary but
7629ac
+    limited capability. As such, motivation exists to monitor these programs for
7629ac
+    unusual activity.
7629ac
+
7629ac
+severity: medium
7629ac
+
7629ac
+references:
7629ac
+    ospp@rhel7: FAU_GEN.1.1.c
7629ac
+
7629ac
+ocil_clause: 'it is not the case'
7629ac
+
7629ac
+ocil: |-
7629ac
+    To verify that auditing of privileged command use is configured, run the
7629ac
+    following command:
7629ac
+    
$ sudo grep mount /etc/audit/audit.rules /etc/audit/rules.d/*
7629ac
+    It should return a relevant line in the audit rules.
7629ac
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgidmap.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgidmap.rule
7629ac
new file mode 100644
7629ac
index 0000000000..bd8dbcf1bd
7629ac
--- /dev/null
7629ac
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgidmap.rule
7629ac
@@ -0,0 +1,42 @@
7629ac
+documentation_complete: true
7629ac
+
7629ac
+prodtype: rhel7,fedora
7629ac
+
7629ac
+title: 'Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap'
7629ac
+
7629ac
+description: |-
7629ac
+    At a minimum, the audit system should collect the execution of
7629ac
+    privileged commands for all users and root. If the <tt>auditd</tt> daemon is
7629ac
+    configured to use the <tt>augenrules</tt> program to read audit rules during
7629ac
+    daemon startup (the default), add a line of the following form to a file with
7629ac
+    suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
7629ac
+    
-a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
7629ac
+    utility to read audit rules during daemon startup, add a line of the following
7629ac
+    form to <tt>/etc/audit/audit.rules</tt>:
7629ac
+    
-a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
7629ac
+
7629ac
+rationale: |-
7629ac
+    Misuse of privileged functions, either intentionally or unintentionally by
7629ac
+    authorized users, or by unauthorized external entities that have compromised system accounts,
7629ac
+    is a serious and ongoing concern and can have significant adverse impacts on organizations.
7629ac
+    Auditing the use of privileged functions is one way to detect such misuse and identify
7629ac
+    the risk from insider and advanced persistent threast.
7629ac
+    

7629ac
+    Privileged programs are subject to escalation-of-privilege attacks,
7629ac
+    which attempt to subvert their normal role of providing some necessary but
7629ac
+    limited capability. As such, motivation exists to monitor these programs for
7629ac
+    unusual activity.
7629ac
+
7629ac
+severity: medium
7629ac
+
7629ac
+references:
7629ac
+    ospp@rhel7: FAU_GEN.1.1.c
7629ac
+
7629ac
+ocil_clause: 'it is not the case'
7629ac
+
7629ac
+ocil: |-
7629ac
+    To verify that auditing of privileged command use is configured, run the
7629ac
+    following command:
7629ac
+    
$ sudo grep newgidmap /etc/audit/audit.rules /etc/audit/rules.d/*
7629ac
+    It should return a relevant line in the audit rules.
7629ac
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newuidmap.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newuidmap.rule
7629ac
new file mode 100644
7629ac
index 0000000000..199dc381a1
7629ac
--- /dev/null
7629ac
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newuidmap.rule
7629ac
@@ -0,0 +1,42 @@
7629ac
+documentation_complete: true
7629ac
+
7629ac
+prodtype: rhel7,fedora
7629ac
+
7629ac
+title: 'Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap'
7629ac
+
7629ac
+description: |-
7629ac
+    At a minimum, the audit system should collect the execution of
7629ac
+    privileged commands for all users and root. If the <tt>auditd</tt> daemon is
7629ac
+    configured to use the <tt>augenrules</tt> program to read audit rules during
7629ac
+    daemon startup (the default), add a line of the following form to a file with
7629ac
+    suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
7629ac
+    
-a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
7629ac
+    utility to read audit rules during daemon startup, add a line of the following
7629ac
+    form to <tt>/etc/audit/audit.rules</tt>:
7629ac
+    
-a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
7629ac
+
7629ac
+rationale: |-
7629ac
+    Misuse of privileged functions, either intentionally or unintentionally by
7629ac
+    authorized users, or by unauthorized external entities that have compromised system accounts,
7629ac
+    is a serious and ongoing concern and can have significant adverse impacts on organizations.
7629ac
+    Auditing the use of privileged functions is one way to detect such misuse and identify
7629ac
+    the risk from insider and advanced persistent threast.
7629ac
+    

7629ac
+    Privileged programs are subject to escalation-of-privilege attacks,
7629ac
+    which attempt to subvert their normal role of providing some necessary but
7629ac
+    limited capability. As such, motivation exists to monitor these programs for
7629ac
+    unusual activity.
7629ac
+
7629ac
+severity: medium
7629ac
+
7629ac
+references:
7629ac
+    ospp@rhel7: FAU_GEN.1.1.c
7629ac
+
7629ac
+ocil_clause: 'it is not the case'
7629ac
+
7629ac
+ocil: |-
7629ac
+    To verify that auditing of privileged command use is configured, run the
7629ac
+    following command:
7629ac
+    
$ sudo grep newuidmap /etc/audit/audit.rules /etc/audit/rules.d/*
7629ac
+    It should return a relevant line in the audit rules.
7629ac
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_usernetctl.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_usernetctl.rule
7629ac
new file mode 100644
7629ac
index 0000000000..c574f82d25
7629ac
--- /dev/null
7629ac
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_usernetctl.rule
7629ac
@@ -0,0 +1,42 @@
7629ac
+documentation_complete: true
7629ac
+
7629ac
+prodtype: rhel7,fedora
7629ac
+
7629ac
+title: 'Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl'
7629ac
+
7629ac
+description: |-
7629ac
+    At a minimum, the audit system should collect the execution of
7629ac
+    privileged commands for all users and root. If the <tt>auditd</tt> daemon is
7629ac
+    configured to use the <tt>augenrules</tt> program to read audit rules during
7629ac
+    daemon startup (the default), add a line of the following form to a file with
7629ac
+    suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
7629ac
+    
-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
7629ac
+    utility to read audit rules during daemon startup, add a line of the following
7629ac
+    form to <tt>/etc/audit/audit.rules</tt>:
7629ac
+    
-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
7629ac
+
7629ac
+rationale: |-
7629ac
+    Misuse of privileged functions, either intentionally or unintentionally by
7629ac
+    authorized users, or by unauthorized external entities that have compromised system accounts,
7629ac
+    is a serious and ongoing concern and can have significant adverse impacts on organizations.
7629ac
+    Auditing the use of privileged functions is one way to detect such misuse and identify
7629ac
+    the risk from insider and advanced persistent threast.
7629ac
+    

7629ac
+    Privileged programs are subject to escalation-of-privilege attacks,
7629ac
+    which attempt to subvert their normal role of providing some necessary but
7629ac
+    limited capability. As such, motivation exists to monitor these programs for
7629ac
+    unusual activity.
7629ac
+
7629ac
+severity: medium
7629ac
+
7629ac
+references:
7629ac
+    ospp@rhel7: FAU_GEN.1.1.c
7629ac
+
7629ac
+ocil_clause: 'it is not the case'
7629ac
+
7629ac
+ocil: |-
7629ac
+    To verify that auditing of privileged command use is configured, run the
7629ac
+    following command:
7629ac
+    
$ sudo grep usernetctl /etc/audit/audit.rules /etc/audit/rules.d/*
7629ac
+    It should return a relevant line in the audit rules.
7629ac
diff --git a/rhel7/profiles/ospp42-draft.profile b/rhel7/profiles/ospp42-draft.profile
7629ac
index 9802576814..270a94f85f 100644
7629ac
--- a/rhel7/profiles/ospp42-draft.profile
7629ac
+++ b/rhel7/profiles/ospp42-draft.profile
7629ac
@@ -121,6 +121,7 @@ selections:
7629ac
     - audit_rules_execution_restorecon
7629ac
     - audit_rules_execution_semanage
7629ac
     - audit_rules_execution_setsebool
7629ac
+    - audit_rules_execution_seunshare
7629ac
     - audit_rules_mac_modification
7629ac
     - audit_rules_dac_modification_chown
7629ac
     - audit_rules_unsuccessful_file_modification_chown
7629ac
@@ -130,15 +131,20 @@ selections:
7629ac
     - audit_rules_unsuccessful_file_modification_fchown
7629ac
     - audit_rules_dac_modification_lchown
7629ac
     - audit_rules_unsuccessful_file_modification_lchown
7629ac
+    - audit_rules_privileged_commands_at
7629ac
+    - audit_rules_privileged_commands_mount
7629ac
     - audit_rules_privileged_commands_passwd
7629ac
     - audit_rules_privileged_commands_unix_chkpwd
7629ac
     - audit_rules_privileged_commands_userhelper
7629ac
+    - audit_rules_privileged_commands_usernetctl
7629ac
     - audit_rules_privileged_commands_chage
7629ac
     - audit_rules_privileged_commands_chsh
7629ac
     - audit_rules_privileged_commands_pt_chown
7629ac
     - audit_rules_sysadmin_actions
7629ac
     - audit_rules_privileged_commands_gpasswd
7629ac
+    - audit_rules_privileged_commands_newgidmap
7629ac
     - audit_rules_privileged_commands_newgrp
7629ac
+    - audit_rules_privileged_commands_newuidmap
7629ac
     - audit_rules_usergroup_modification_group
7629ac
     - audit_rules_usergroup_modification_gshadow
7629ac
     - audit_rules_usergroup_modification_opasswd
7629ac
diff --git a/shared/bash_remediation_functions/perform_audit_rules_privileged_commands_remediation.sh b/shared/bash_remediation_functions/perform_audit_rules_privileged_commands_remediation.sh
7629ac
index 73a08dd98a..3fd55c84d4 100644
7629ac
--- a/shared/bash_remediation_functions/perform_audit_rules_privileged_commands_remediation.sh
7629ac
+++ b/shared/bash_remediation_functions/perform_audit_rules_privileged_commands_remediation.sh
7629ac
@@ -79,7 +79,7 @@ do
7629ac
 	local count_of_inspected_files=0
7629ac
 
7629ac
 	# Define expected rule form for this binary
7629ac
-	expected_rule="-a always,exit -F path=${sbinary} -F perm=x -F auid>=${min_auid} -F auid!=4294967295 -k privileged"
7629ac
+	expected_rule="-a always,exit -F path=${sbinary} -F perm=x -F auid>=${min_auid} -F auid!=unset -k privileged"
7629ac
 
7629ac
 	# If list of audit rules files to be inspected is empty, just add new rule and move on to next binary
7629ac
 	if [[ ${#files_to_inspect[@]} -eq 0 ]]; then
7629ac
@@ -100,9 +100,9 @@ do
7629ac
 		# * existing rule contains all arguments from expected rule form (though can contain
7629ac
 		#   them in arbitrary order)
7629ac
 	
7629ac
-		base_search=$(sed -e '/-a always,exit/!d' -e '/-F path='"${sbinary_esc}"'/!d' \
7629ac
-				-e '/-F path=[^[:space:]]\+/!d'   -e '/-F perm=.*/!d'                 \
7629ac
-				-e '/-F auid>='"${min_auid}"'/!d' -e '/-F auid!=4294967295/!d'        \
7629ac
+		base_search=$(sed -e '/-a always,exit/!d' -e '/-F path='"${sbinary_esc}"'/!d'		\
7629ac
+				-e '/-F path=[^[:space:]]\+/!d'   -e '/-F perm=.*/!d'						\
7629ac
+				-e '/-F auid>='"${min_auid}"'/!d' -e '/-F auid!=\(?:4294967295\|unset\)/!d'	\
7629ac
 				-e '/-k privileged/!d' "$afile")
7629ac
 
7629ac
 		# Increase the count of inspected files for this sbinary
7629ac
diff --git a/shared/templates/csv/audit_rules_execution.csv b/shared/templates/csv/audit_rules_execution.csv
7629ac
index 8a78a4323c..45aa7493f3 100644
7629ac
--- a/shared/templates/csv/audit_rules_execution.csv
7629ac
+++ b/shared/templates/csv/audit_rules_execution.csv
7629ac
@@ -3,3 +3,4 @@
7629ac
 /usr/sbin/semanage
7629ac
 /usr/sbin/setfiles
7629ac
 /usr/sbin/setsebool
7629ac
+/usr/sbin/seunshare
7629ac
diff --git a/shared/templates/csv/audit_rules_privileged_commands.csv b/shared/templates/csv/audit_rules_privileged_commands.csv
7629ac
index 2d45332344..7fa26ffe2d 100644
7629ac
--- a/shared/templates/csv/audit_rules_privileged_commands.csv
7629ac
+++ b/shared/templates/csv/audit_rules_privileged_commands.csv
7629ac
@@ -1,8 +1,12 @@
7629ac
+/usr/bin/at
7629ac
 /usr/bin/chage
7629ac
 /usr/bin/chsh
7629ac
 /usr/bin/crontab
7629ac
 /usr/bin/gpasswd
7629ac
+/usr/bin/mount
7629ac
+/usr/bin/newgidmap
7629ac
 /usr/bin/newgrp
7629ac
+/usr/bin/newuidmap
7629ac
 /usr/sbin/pam_timestamp_check
7629ac
 /usr/bin/passwd
7629ac
 /usr/sbin/postdrop
7629ac
@@ -15,3 +19,4 @@
7629ac
 /usr/bin/umount
7629ac
 /usr/sbin/unix_chkpwd
7629ac
 /usr/sbin/userhelper
7629ac
+/usr/sbin/usernetctl
7629ac
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/generate_privileged_commands_rule.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/generate_privileged_commands_rule.sh
7629ac
new file mode 100755
7629ac
index 0000000000..9dc0cd1ce2
7629ac
--- /dev/null
7629ac
+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/generate_privileged_commands_rule.sh
7629ac
@@ -0,0 +1,8 @@
7629ac
+#!/bin/bash
7629ac
+
7629ac
+AUID=$1
7629ac
+KEY=$2
7629ac
+RULEPATH=$3
7629ac
+for file in $(find / -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null); do
7629ac
+     echo "-a always,exit -F path=$file -F perm=x -F auid>=$AUID -F auid!=unset -k $KEY" >> $RULEPATH
7629ac
+done
7629ac
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_audit.rules b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_audit.rules
7629ac
deleted file mode 100644
7629ac
index 703bbafe10..0000000000
7629ac
--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_audit.rules
7629ac
+++ /dev/null
7629ac
@@ -1,37 +0,0 @@
7629ac
--a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/at -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/wall -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/write -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/ksu -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/locate -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/pkexec -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/libexec/polkit-1/polkit-agent-helper-1 -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/libexec/pt_chown -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/libexec/utempter/utempter -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/sbin/netreport -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/sbin/pam_timestamp_check -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/lib64/dbus-1/dbus-daemon-launch-helper -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/bin/mount -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/bin/su -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/bin/umount -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/bin/cgclassify -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/bin/cgexec -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/bin/ping6 -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
7629ac
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_auditctl_rules_configured.pass.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_auditctl_rules_configured.pass.sh
7629ac
index 60b9eb0c45..a8a25ebdb3 100644
7629ac
--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_auditctl_rules_configured.pass.sh
7629ac
+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_auditctl_rules_configured.pass.sh
7629ac
@@ -2,7 +2,6 @@
7629ac
 # profiles = xccdf_org.ssgproject.content_profile_pci-dss
7629ac
 # remediation = bash
7629ac
 
7629ac
-cp rhel6_audit.rules /etc/audit/rules.d/privileged.rules
7629ac
-cp rhel6_audit.rules /etc/audit/audit.rules
7629ac
+./generate_privileged_commands_rule.sh 500 privileged /etc/audit/audit.rules
7629ac
 # This is a trick to fail setup of this test in rhel7 systems
7629ac
 ls /etc/sysconfig/auditd
7629ac
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_augenrules_rules_configured.pass.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_augenrules_rules_configured.pass.sh
7629ac
index 1b628be506..5594d7566a 100644
7629ac
--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_augenrules_rules_configured.pass.sh
7629ac
+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_augenrules_rules_configured.pass.sh
7629ac
@@ -2,6 +2,5 @@
7629ac
 # profiles = xccdf_org.ssgproject.content_profile_pci-dss
7629ac
 # remediation = bash
7629ac
 
7629ac
-cp rhel6_audit.rules /etc/audit/rules.d/privileged.rules
7629ac
-cp rhel6_audit.rules /etc/audit/audit.rules
7629ac
+./generate_privileged_commands_rule.sh 500 privileged /etc/audit/rules.d/privileged.rules
7629ac
 sed -i "s/USE_AUGENRULES=.*/USE_AUGENRULES=\"yes\"/" /etc/sysconfig/auditd
7629ac
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_auditctl_rules_configured.pass.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_auditctl_rules_configured.pass.sh
7629ac
index ee95d13d5d..3f891eed60 100644
7629ac
--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_auditctl_rules_configured.pass.sh
7629ac
+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_auditctl_rules_configured.pass.sh
7629ac
@@ -2,6 +2,5 @@
7629ac
 # profiles = xccdf_org.ssgproject.content_profile_pci-dss
7629ac
 # remediation = bash
7629ac
 
7629ac
-cp rhel7_privileged.rules /etc/audit/rules.d/privileged.rules
7629ac
-cp rhel7_privileged.rules /etc/audit/audit.rules
7629ac
+./generate_privileged_commands_rule.sh 1000 privileged /etc/audit/audit.rules
7629ac
 sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
7629ac
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_augenrules_rules_configured.pass.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_augenrules_rules_configured.pass.sh
7629ac
index 77f9549418..74583bf989 100644
7629ac
--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_augenrules_rules_configured.pass.sh
7629ac
+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_augenrules_rules_configured.pass.sh
7629ac
@@ -2,7 +2,6 @@
7629ac
 # profiles = xccdf_org.ssgproject.content_profile_pci-dss
7629ac
 # remediation = bash
7629ac
 
7629ac
-cp rhel7_privileged.rules /etc/audit/rules.d/privileged.rules
7629ac
-cp rhel7_privileged.rules /etc/audit/audit.rules
7629ac
+./generate_privileged_commands_rule.sh 1000 privileged /etc/audit/rules.d/privileged.rules
7629ac
 # This is a trick to fail setup of this test in rhel6 systems
7629ac
 ls /usr/lib/systemd/system/auditd.service
7629ac
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_own_key.rules b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_own_key.rules
7629ac
deleted file mode 100644
7629ac
index 4df6d4ec8b..0000000000
7629ac
--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_own_key.rules
7629ac
+++ /dev/null
7629ac
@@ -1,30 +0,0 @@
7629ac
--a always,exit -F path=/usr/bin/wall -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/bin/write -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/bin/pkexec -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/bin/locate -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/sbin/netreport -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/lib/polkit-1/polkit-agent-helper-1 -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/libexec/utempter/utempter -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/libexec/dbus-1/dbus-daemon-launch-helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
--a always,exit -F path=/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
7629ac
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_privileged.rules b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_privileged.rules
7629ac
deleted file mode 100644
7629ac
index 4eb644acbc..0000000000
7629ac
--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_privileged.rules
7629ac
+++ /dev/null
7629ac
@@ -1,30 +0,0 @@
7629ac
--a always,exit -F path=/usr/bin/wall -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/write -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/pkexec -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/bin/locate -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/sbin/netreport -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/lib/polkit-1/polkit-agent-helper-1 -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/libexec/utempter/utempter -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/libexec/dbus-1/dbus-daemon-launch-helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
--a always,exit -F path=/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
7629ac
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_rules_with_own_key.pass.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_rules_with_own_key.pass.sh
7629ac
index ac5ef2ddd9..35a5fde2c6 100644
7629ac
--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_rules_with_own_key.pass.sh
7629ac
+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_rules_with_own_key.pass.sh
7629ac
@@ -2,7 +2,6 @@
7629ac
 # profiles = xccdf_org.ssgproject.content_profile_pci-dss
7629ac
 # remediation = bash
7629ac
 
7629ac
-cp rhel7_own_key.rules /etc/audit/rules.d/privileged.rules
7629ac
-cp rhel7_own_key.rules /etc/audit/audit.rules
7629ac
+./generate_privileged_commands_rule.sh 1000 own_key /etc/audit/rules.d/privileged.rules
7629ac
 # This is a trick to fail setup of this test in rhel6 systems
7629ac
 ls /usr/lib/systemd/system/auditd.service