|
 |
7629ac |
diff --git a/shared/checks/oval/audit_rules_unsuccessful_file_modification_open_o_creat.xml b/shared/checks/oval/audit_rules_unsuccessful_file_modification_open_o_creat.xml
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000000..3eb97c1234
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/shared/checks/oval/audit_rules_unsuccessful_file_modification_open_o_creat.xml
|
|
|
7629ac |
@@ -0,0 +1,200 @@
|
|
|
7629ac |
+<def-group>
|
|
|
7629ac |
+ <definition class="compliance" id="audit_rules_unsuccessful_file_modification_open_o_creat" version="1">
|
|
|
7629ac |
+ <metadata>
|
|
|
7629ac |
+ <title>Ensure auditd Collects Information on Unsuccesful Creation Attempts to Files - open o_creat</title>
|
|
|
7629ac |
+ <affected family="unix">
|
|
|
7629ac |
+ <platform>Red Hat Enterprise Linux 7</platform>
|
|
|
7629ac |
+ <platform>multi_platform_fedora</platform>
|
|
|
7629ac |
+ </affected>
|
|
|
7629ac |
+ <description>Audit rules about the information on the unsuccessful use of open O_CREAT is enabled.</description>
|
|
|
7629ac |
+ </metadata>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="OR">
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="AND">
|
|
|
7629ac |
+ <extend_definition comment="audit augenrules" definition_ref="audit_rules_augenrules" />
|
|
|
7629ac |
+ <criterion comment="Verify audit rule open 32bit a2&0100 eacces augenrules exists" test_ref="test_arufm_open_o_creat_32bit_a20100_eacces_augenrules" />
|
|
|
7629ac |
+ <criterion comment="Verify audit rule open 32bit a2&0100 eperm augenrules exists" test_ref="test_arufm_open_o_creat_32bit_a20100_eperm_augenrules" />
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="OR">
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <extend_definition comment="64-bit system" definition_ref="system_info_architecture_64bit" negate="true" />
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="AND">
|
|
|
7629ac |
+ <criterion comment="Verify audit rule open 64bit a2&0100 eacces augenrules exists" test_ref="test_arufm_open_o_creat_64bit_a20100_eacces_augenrules" />
|
|
|
7629ac |
+ <criterion comment="Verify audit rule open 64bit a2&0100 eperm augenrules exists" test_ref="test_arufm_open_o_creat_64bit_a20100_eperm_augenrules" />
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="AND">
|
|
|
7629ac |
+ <extend_definition comment="audit auditctl" definition_ref="audit_rules_auditctl" />
|
|
|
7629ac |
+ <criterion comment="Verify audit rule open 32bit a2&0100 eacces auditctl exists" test_ref="test_arufm_open_o_creat_32bit_a20100_eacces_auditctl" />
|
|
|
7629ac |
+ <criterion comment="Verify audit rule open 32bit a2&0100 eperm auditctl exists" test_ref="test_arufm_open_o_creat_32bit_a20100_eperm_auditctl" />
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="OR">
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <extend_definition comment="64-bit_system" definition_ref="system_info_architecture_64bit" negate="true" />
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="AND">
|
|
|
7629ac |
+ <criterion comment="Verify audit rule open 64bit a2&0100 eacces auditctl exists" test_ref="test_arufm_open_o_creat_64bit_a20100_eacces_auditctl" />
|
|
|
7629ac |
+ <criterion comment="Verify audit rule open 64bit a2&0100 eperm auditctl exists" test_ref="test_arufm_open_o_creat_64bit_a20100_eperm_auditctl" />
|
|
|
7629ac |
+
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+ </definition>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <constant_variable id="var_audit_rule_open_o_creat_32bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
|
|
|
7629ac |
+ <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S(?:[\s]+open[\s]+|(?:[\s]+|[,])open(?:[\s]+|[,])))[\S]*[\s]*</value>
|
|
|
7629ac |
+ </constant_variable>
|
|
|
7629ac |
+ <constant_variable id="var_audit_rule_open_o_creat_64bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
|
|
|
7629ac |
+ <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S(?:[\s]+open[\s]+|(?:[\s]+|[,])open(?:[\s]+|[,])))[\S]*[\s]*</value>
|
|
|
7629ac |
+ </constant_variable>
|
|
|
7629ac |
+ <constant_variable id="var_audit_rule_open_o_creat_tail" version="1" datatype="string" comment="audit rule auid and key">
|
|
|
7629ac |
+ <value>[\s]+(?:-F\s+auid>={{{ auid }}}[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
|
|
|
7629ac |
+ </constant_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <constant_variable id="var_audit_rule_open_o_creat_separator_regex" version="1" datatype="string" comment="audit rule auid and key">
|
|
|
7629ac |
+ <value>(?:[^.]|\.\s)*</value>
|
|
|
7629ac |
+ </constant_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_o_creat_32bit_a20100_eacces_regex" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EACCES syscall">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_o_creat_32bit_head" />
|
|
|
7629ac |
+ <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_o_creat_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_o_creat_32bit_a20100_eperm_regex" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EPERM syscall">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_o_creat_32bit_head" />
|
|
|
7629ac |
+ <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_o_creat_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_o_creat_64bit_a20100_eacces_regex" version="1" datatype="string" comment="Expression to match 64bit open O_CREAT EACCES syscall">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_o_creat_64bit_head" />
|
|
|
7629ac |
+ <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_o_creat_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_o_creat_64bit_a20100_eperm_regex" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EPERM syscall">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_o_creat_64bit_head" />
|
|
|
7629ac |
+ <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_o_creat_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_o_creat_32bit_a20100_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_o_creat_32bit_a20100_eacces_augenrules" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_o_creat_32bit_a20100_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_creat_32bit_a20100_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_o_creat_32bit_a20100_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_o_creat_32bit_a20100_eperm_augenrules" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_o_creat_32bit_a20100_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_creat_32bit_a20100_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_o_creat_64bit_a20100_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_o_creat_64bit_a20100_eacces_augenrules" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_o_creat_64bit_a20100_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_creat_64bit_a20100_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_o_creat_64bit_a20100_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_o_creat_64bit_a20100_eperm_augenrules" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_o_creat_64bit_a20100_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_creat_64bit_a20100_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_o_creat_32bit_a20100_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_o_creat_32bit_a20100_eacces_auditctl" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_o_creat_32bit_a20100_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_creat_32bit_a20100_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_o_creat_32bit_a20100_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_o_creat_32bit_a20100_eperm_auditctl" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_o_creat_32bit_a20100_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_creat_32bit_a20100_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_o_creat_64bit_a20100_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_o_creat_64bit_a20100_eacces_auditctl" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_o_creat_64bit_a20100_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_creat_64bit_a20100_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_o_creat_64bit_a20100_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_o_creat_64bit_a20100_eperm_auditctl" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_o_creat_64bit_a20100_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_creat_64bit_a20100_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+</def-group>
|
|
|
7629ac |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_o_creat.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_o_creat.rule
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000000..c879183de2
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_o_creat.rule
|
|
|
7629ac |
@@ -0,0 +1,54 @@
|
|
|
7629ac |
+documentation_complete: true
|
|
|
7629ac |
+
|
|
|
7629ac |
+prodtype: rhel7,fedora
|
|
|
7629ac |
+
|
|
|
7629ac |
+title: 'Record Unauthorized Creation Attempts to Files (unsuccessful) - open O_CREAT'
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+description: |-
|
|
|
7629ac |
+ The audit system should collect unauthorized file accesses for
|
|
|
7629ac |
+ all users and root. The <tt>open</tt> syscall can be used to create new files
|
|
|
7629ac |
+ when O_CREAT flag is specified.
|
|
|
7629ac |
+ The following auidt rules will asure that unsuccessful attempts to create a
|
|
|
7629ac |
+ file via <tt>open</tt> syscall are collected.
|
|
|
7629ac |
+ If the <tt>auditd</tt> daemon is configured to use the <tt>augenrules</tt>
|
|
|
7629ac |
+ program to read audit rules during daemon startup (the default), add the
|
|
|
7629ac |
+ rules below to a file with suffix <tt>.rules</tt> in the directory
|
|
|
7629ac |
+ <tt>/etc/audit/rules.d</tt>.
|
|
|
7629ac |
+ If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
|
|
|
7629ac |
+ utility to read audit rules during daemon startup, add the rules below to
|
|
|
7629ac |
+ <tt>/etc/audit/audit.rules</tt> file.
|
|
|
7629ac |
+
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S open -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S open -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
|
|
7629ac |
+
|
|
|
7629ac |
+ If the system is 64 bit then also add the following lines:
|
|
|
7629ac |
+
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S open -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S open -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+rationale: |-
|
|
|
7629ac |
+ Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
|
|
|
7629ac |
+ these events could serve as evidence of potential system compromise.
|
|
|
7629ac |
+
|
|
|
7629ac |
+severity: medium
|
|
|
7629ac |
+
|
|
|
7629ac |
+references:
|
|
|
7629ac |
+ cis: 5.2.10
|
|
|
7629ac |
+ cui: 3.1.7
|
|
|
7629ac |
+ disa: 172,2884
|
|
|
7629ac |
+ hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
|
|
|
7629ac |
+ nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
|
|
|
7629ac |
+ ospp@rhel7: FAU_GEN.1.1.c
|
|
|
7629ac |
+ pcidss: Req-10.2.4,Req-10.2.1
|
|
|
7629ac |
+ srg: SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205,SRG-OS-000392-GPOS-00172
|
|
|
7629ac |
+
|
|
|
7629ac |
+{{{ complete_ocil_entry_audit_syscall(syscall="open") }}}
|
|
|
7629ac |
+
|
|
|
7629ac |
+warnings:
|
|
|
7629ac |
+ - general: |-
|
|
|
7629ac |
+ Note that these rules can be configured in a
|
|
|
7629ac |
+ number of ways while still achieving the desired effect. Here the system calls
|
|
|
7629ac |
+ have been placed independent of other system calls. Grouping these system
|
|
|
7629ac |
+ calls with others as identifying earlier in this guide is more efficient.
|
|
|
7629ac |
diff --git a/shared/checks/oval/audit_rules_unsuccessful_file_modification_open_o_trunc_write.xml b/shared/checks/oval/audit_rules_unsuccessful_file_modification_open_o_trunc_write.xml
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000000..49540d8d4c
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/shared/checks/oval/audit_rules_unsuccessful_file_modification_open_o_trunc_write.xml
|
|
|
7629ac |
@@ -0,0 +1,200 @@
|
|
|
7629ac |
+<def-group>
|
|
|
7629ac |
+ <definition class="compliance" id="audit_rules_unsuccessful_file_modification_open_o_trunc_write" version="1">
|
|
|
7629ac |
+ <metadata>
|
|
|
7629ac |
+ <title>Ensure auditd Collects Information on Unsuccesful Creation Attempts to Files - open o_trunc</title>
|
|
|
7629ac |
+ <affected family="unix">
|
|
|
7629ac |
+ <platform>Red Hat Enterprise Linux 7</platform>
|
|
|
7629ac |
+ <platform>multi_platform_fedora</platform>
|
|
|
7629ac |
+ </affected>
|
|
|
7629ac |
+ <description>Audit rules about the information on the unsuccessful use of open O_TRUNC is enabled.</description>
|
|
|
7629ac |
+ </metadata>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="OR">
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="AND">
|
|
|
7629ac |
+ <extend_definition comment="audit augenrules" definition_ref="audit_rules_augenrules" />
|
|
|
7629ac |
+ <criterion comment="Verify audit rule open 32bit a2&01003 eacces augenrules exists" test_ref="test_arufm_open_o_trunc_32bit_a201003_eacces_augenrules" />
|
|
|
7629ac |
+ <criterion comment="Verify audit rule open 32bit a2&01003 eperm augenrules exists" test_ref="test_arufm_open_o_trunc_32bit_a201003_eperm_augenrules" />
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="OR">
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <extend_definition comment="64-bit system" definition_ref="system_info_architecture_64bit" negate="true" />
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="AND">
|
|
|
7629ac |
+ <criterion comment="Verify audit rule open 64bit a2&01003 eacces augenrules exists" test_ref="test_arufm_open_o_trunc_64bit_a201003_eacces_augenrules" />
|
|
|
7629ac |
+ <criterion comment="Verify audit rule open 64bit a2&01003 eperm augenrules exists" test_ref="test_arufm_open_o_trunc_64bit_a201003_eperm_augenrules" />
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="AND">
|
|
|
7629ac |
+ <extend_definition comment="audit auditctl" definition_ref="audit_rules_auditctl" />
|
|
|
7629ac |
+ <criterion comment="Verify audit rule open 32bit a2&01003 eacces auditctl exists" test_ref="test_arufm_open_o_trunc_32bit_a201003_eacces_auditctl" />
|
|
|
7629ac |
+ <criterion comment="Verify audit rule open 32bit a2&01003 eperm auditctl exists" test_ref="test_arufm_open_o_trunc_32bit_a201003_eperm_auditctl" />
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="OR">
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <extend_definition comment="64-bit_system" definition_ref="system_info_architecture_64bit" negate="true" />
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="AND">
|
|
|
7629ac |
+ <criterion comment="Verify audit rule open 64bit a2&01003 eacces auditctl exists" test_ref="test_arufm_open_o_trunc_64bit_a201003_eacces_auditctl" />
|
|
|
7629ac |
+ <criterion comment="Verify audit rule open 64bit a2&01003 eperm auditctl exists" test_ref="test_arufm_open_o_trunc_64bit_a201003_eperm_auditctl" />
|
|
|
7629ac |
+
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+ </definition>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <constant_variable id="var_audit_rule_open_o_trunc_32bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
|
|
|
7629ac |
+ <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S(?:[\s]+open[\s]+|(?:[\s]+|[,])open(?:[\s]+|[,])))[\S]*[\s]*</value>
|
|
|
7629ac |
+ </constant_variable>
|
|
|
7629ac |
+ <constant_variable id="var_audit_rule_open_o_trunc_64bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
|
|
|
7629ac |
+ <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S(?:[\s]+open[\s]+|(?:[\s]+|[,])open(?:[\s]+|[,])))[\S]*[\s]*</value>
|
|
|
7629ac |
+ </constant_variable>
|
|
|
7629ac |
+ <constant_variable id="var_audit_rule_open_o_trunc_tail" version="1" datatype="string" comment="audit rule auid and key">
|
|
|
7629ac |
+ <value>[\s]+(?:-F\s+auid>={{{ auid }}}[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
|
|
|
7629ac |
+ </constant_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <constant_variable id="var_audit_rule_open_o_trunc_separator_regex" version="1" datatype="string" comment="audit rule auid and key">
|
|
|
7629ac |
+ <value>(?:[^.]|\.\s)*</value>
|
|
|
7629ac |
+ </constant_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex" version="1" datatype="string" comment="Expression to match 32bit open O_TRUNC EACCES syscall">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_o_trunc_32bit_head" />
|
|
|
7629ac |
+ <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_o_trunc_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex" version="1" datatype="string" comment="Expression to match 32bit open O_TRUNC EPERM EACCES syscall">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_o_trunc_32bit_head" />
|
|
|
7629ac |
+ <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_o_trunc_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex" version="1" datatype="string" comment="Expression to match 64bit open O_TRUNC EACCES syscall">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_o_trunc_64bit_head" />
|
|
|
7629ac |
+ <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_o_trunc_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex" version="1" datatype="string" comment="Expression to match 64bit open O_TRUNC EPERM syscall">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_o_trunc_64bit_head" />
|
|
|
7629ac |
+ <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_o_trunc_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_o_trunc_32bit_a201003_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_o_trunc_32bit_a201003_eacces_augenrules" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_o_trunc_32bit_a201003_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_o_trunc_32bit_a201003_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_o_trunc_32bit_a201003_eperm_augenrules" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_o_trunc_32bit_a201003_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_o_trunc_64bit_a201003_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_o_trunc_64bit_a201003_eacces_augenrules" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_o_trunc_64bit_a201003_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_o_trunc_64bit_a201003_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_o_trunc_64bit_a201003_eperm_augenrules" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_o_trunc_64bit_a201003_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_o_trunc_32bit_a201003_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_o_trunc_32bit_a201003_eacces_auditctl" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_o_trunc_32bit_a201003_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_o_trunc_32bit_a201003_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_o_trunc_32bit_a201003_eperm_auditctl" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_o_trunc_32bit_a201003_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_o_trunc_64bit_a201003_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_o_trunc_64bit_a201003_eacces_auditctl" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_o_trunc_64bit_a201003_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_o_trunc_64bit_a201003_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_o_trunc_64bit_a201003_eperm_auditctl" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_o_trunc_64bit_a201003_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+</def-group>
|
|
|
7629ac |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_o_trunc_write.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_o_trunc_write.rule
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000000..8525b31bb1
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_o_trunc_write.rule
|
|
|
7629ac |
@@ -0,0 +1,53 @@
|
|
|
7629ac |
+documentation_complete: true
|
|
|
7629ac |
+
|
|
|
7629ac |
+prodtype: rhel7,fedora
|
|
|
7629ac |
+
|
|
|
7629ac |
+title: 'Record Unauthorized Modification Attempts to Files (unsuccessful) - open O_TRUNC'
|
|
|
7629ac |
+
|
|
|
7629ac |
+description: |-
|
|
|
7629ac |
+ The audit system should collect detailed unauthorized file accesses for
|
|
|
7629ac |
+ all users and root. The <tt>open</tt> syscall can be used to modify files
|
|
|
7629ac |
+ if called for write operation of with O_TRUNC flag.
|
|
|
7629ac |
+ The following auidt rules will asure that unsuccessful attempts to modify a
|
|
|
7629ac |
+ file via <tt>open</tt> syscall are collected.
|
|
|
7629ac |
+ If the <tt>auditd</tt> daemon is configured to use the <tt>augenrules</tt>
|
|
|
7629ac |
+ program to read audit rules during daemon startup (the default), add the
|
|
|
7629ac |
+ rules below to a file with suffix <tt>.rules</tt> in the directory
|
|
|
7629ac |
+ <tt>/etc/audit/rules.d</tt>.
|
|
|
7629ac |
+ If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
|
|
|
7629ac |
+ utility to read audit rules during daemon startup, add the rules below to
|
|
|
7629ac |
+ <tt>/etc/audit/audit.rules</tt> file.
|
|
|
7629ac |
+
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S open -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S open -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
|
|
7629ac |
+
|
|
|
7629ac |
+ If the system is 64 bit then also add the following lines:
|
|
|
7629ac |
+
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S open -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S open -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+rationale: |-
|
|
|
7629ac |
+ Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
|
|
|
7629ac |
+ these events could serve as evidence of potential system compromise.
|
|
|
7629ac |
+
|
|
|
7629ac |
+severity: medium
|
|
|
7629ac |
+
|
|
|
7629ac |
+references:
|
|
|
7629ac |
+ cis: 5.2.10
|
|
|
7629ac |
+ cui: 3.1.7
|
|
|
7629ac |
+ disa: 172,2884
|
|
|
7629ac |
+ hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
|
|
|
7629ac |
+ nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
|
|
|
7629ac |
+ ospp@rhel7: FAU_GEN.1.1.c
|
|
|
7629ac |
+ pcidss: Req-10.2.4,Req-10.2.1
|
|
|
7629ac |
+ srg: SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205,SRG-OS-000392-GPOS-00172
|
|
|
7629ac |
+
|
|
|
7629ac |
+{{{ complete_ocil_entry_audit_syscall(syscall="open") }}}
|
|
|
7629ac |
+
|
|
|
7629ac |
+warnings:
|
|
|
7629ac |
+ - general: |-
|
|
|
7629ac |
+ Note that these rules can be configured in a
|
|
|
7629ac |
+ number of ways while still achieving the desired effect. Here the system calls
|
|
|
7629ac |
+ have been placed independent of other system calls. Grouping these system
|
|
|
7629ac |
+ calls with others as identifying earlier in this guide is more efficient.
|
|
|
7629ac |
diff --git a/shared/checks/oval/audit_rules_unsuccessful_file_modification_open_rule_order.xml b/shared/checks/oval/audit_rules_unsuccessful_file_modification_open_rule_order.xml
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000000..780fdf60d4
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/shared/checks/oval/audit_rules_unsuccessful_file_modification_open_rule_order.xml
|
|
|
7629ac |
@@ -0,0 +1,474 @@
|
|
|
7629ac |
+<def-group>
|
|
|
7629ac |
+ <definition class="compliance" id="audit_rules_unsuccessful_file_modification_open_rule_order" version="1">
|
|
|
7629ac |
+ <metadata>
|
|
|
7629ac |
+ <title>Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly</title>
|
|
|
7629ac |
+ <affected family="unix">
|
|
|
7629ac |
+ <platform>Red Hat Enterprise Linux 7</platform>
|
|
|
7629ac |
+ <platform>multi_platform_fedora</platform>
|
|
|
7629ac |
+ </affected>
|
|
|
7629ac |
+ <description>Audit rules about the information on the unsuccessful use of open is configured in the proper rule order.</description>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ </metadata>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="OR">
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="AND">
|
|
|
7629ac |
+ <extend_definition comment="audit augenrules" definition_ref="audit_rules_augenrules" />
|
|
|
7629ac |
+ <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_open_order_32bit_eacces_augenrules" />
|
|
|
7629ac |
+ <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_open_order_32bit_eperm_augenrules" />
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="OR">
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <extend_definition comment="64-bit system" definition_ref="system_info_architecture_64bit" negate="true" />
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="AND">
|
|
|
7629ac |
+ <criterion comment="audit augenrules 64-bit" test_ref="test_arufm_open_order_64bit_eacces_augenrules" />
|
|
|
7629ac |
+ <criterion comment="audit augenrules 64-bit" test_ref="test_arufm_open_order_64bit_eperm_augenrules" />
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="AND">
|
|
|
7629ac |
+ <extend_definition comment="audit auditctl" definition_ref="audit_rules_auditctl" />
|
|
|
7629ac |
+ <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_open_order_32bit_eacces_auditctl" />
|
|
|
7629ac |
+ <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_open_order_32bit_eperm_auditctl" />
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="OR">
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <extend_definition comment="64-bit_system" definition_ref="system_info_architecture_64bit" negate="true" />
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <criteria operator="AND">
|
|
|
7629ac |
+ <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_open_order_64bit_eacces_auditctl" />
|
|
|
7629ac |
+ <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_open_order_64bit_eperm_auditctl" />
|
|
|
7629ac |
+
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ </criteria>
|
|
|
7629ac |
+ </definition>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <constant_variable id="var_audit_rule_open_order_32bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
|
|
|
7629ac |
+ <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S(?:[\s]+open[\s]+|(?:[\s]+|[,])open(?:[\s]+|[,])))[\S]*[\s]*</value>
|
|
|
7629ac |
+ </constant_variable>
|
|
|
7629ac |
+ <constant_variable id="var_audit_rule_open_order_64bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
|
|
|
7629ac |
+ <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S(?:[\s]+open[\s]+|(?:[\s]+|[,])open(?:[\s]+|[,])))[\S]*[\s]*</value>
|
|
|
7629ac |
+ </constant_variable>
|
|
|
7629ac |
+ <constant_variable id="var_audit_rule_open_order_tail" version="1" datatype="string" comment="audit rule auid and key">
|
|
|
7629ac |
+ <value>[\s]+(?:-F\s+auid>={{{ auid }}}[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
|
|
|
7629ac |
+ </constant_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <constant_variable id="var_audit_rule_open_order_separator_regex" version="1" datatype="string" comment="audit rule auid and key">
|
|
|
7629ac |
+ <value>(?:[^.]|\.\s)*</value>
|
|
|
7629ac |
+ </constant_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_order_32bit_a20100_eacces_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_32bit_head" />
|
|
|
7629ac |
+ <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_order_32bit_a201003_eacces_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_32bit_head" />
|
|
|
7629ac |
+ <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_order_32bit_eacces_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_32bit_head" />
|
|
|
7629ac |
+ <literal_component>(?!.*-F\s+a2&)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_order_32bit_a20100_eperm_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_32bit_head" />
|
|
|
7629ac |
+ <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_order_32bit_a201003_eperm_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_32bit_head" />
|
|
|
7629ac |
+ <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_order_32bit_eperm_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_32bit_head" />
|
|
|
7629ac |
+ <literal_component>(?!.*-F\s+a2&)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_order_64bit_a20100_eacces_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_64bit_head" />
|
|
|
7629ac |
+ <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_order_64bit_a201003_eacces_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_64bit_head" />
|
|
|
7629ac |
+ <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_order_64bit_eacces_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_64bit_head" />
|
|
|
7629ac |
+ <literal_component>(?!.*-F\s+a2&)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_order_64bit_a20100_eperm_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_64bit_head" />
|
|
|
7629ac |
+ <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_order_64bit_a201003_eperm_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_64bit_head" />
|
|
|
7629ac |
+ <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+ <local_variable id="var_audit_rule_open_order_64bit_eperm_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_64bit_head" />
|
|
|
7629ac |
+ <literal_component>(?!.*-F\s+a2&)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_tail" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_32bit_a20100_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_a20100_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_32bit_a201003_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_a201003_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_nofilter_32bit_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_arufm_open_order_32bit_eacces_augenrules_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_32bit_a20100_eacces_augenrules" />
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_32bit_a201003_eacces_augenrules" />
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_nofilter_32bit_eacces_augenrules" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_order_32bit_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_order_32bit_eacces_augenrules" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_32bit_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_arufm_open_order_32bit_eacces_augenrules_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_32bit_a20100_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_a20100_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_32bit_a201003_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_a201003_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_nofilter_32bit_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_arufm_open_order_32bit_open_eperm_augenrules_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_32bit_a20100_eperm_augenrules" />
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_32bit_a201003_eperm_augenrules" />
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_nofilter_32bit_eperm_augenrules" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_order_32bit_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_order_32bit_eperm_augenrules" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_32bit_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_arufm_open_order_32bit_open_eperm_augenrules_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_64bit_a20100_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_a20100_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_64bit_a201003_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_a201003_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_nofilter_64bit_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_arufm_open_order_64bit_eacces_augenrules_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_64bit_a20100_eacces_augenrules" />
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_64bit_a201003_eacces_augenrules" />
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_nofilter_64bit_eacces_augenrules" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_order_64bit_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_order_64bit_eacces_augenrules" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_64bit_eacces_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_arufm_open_order_64bit_eacces_augenrules_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_64bit_a20100_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_a20100_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_64bit_a201003_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_a201003_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_nofilter_64bit_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_arufm_open_order_64bit_open_eperm_augenrules_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_64bit_a20100_eperm_augenrules" />
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_64bit_a201003_eperm_augenrules" />
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_nofilter_64bit_eperm_augenrules" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_order_64bit_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_order_64bit_eperm_augenrules" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_64bit_eperm_augenrules" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_arufm_open_order_64bit_open_eperm_augenrules_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_32bit_a20100_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_a20100_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_32bit_a201003_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_a201003_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_nofilter_32bit_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_arufm_open_order_32bit_auditctl_eacces_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_32bit_a20100_eacces_auditctl" />
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_32bit_a201003_eacces_auditctl" />
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_nofilter_32bit_eacces_auditctl" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_order_32bit_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_order_32bit_eacces_auditctl" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_32bit_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_arufm_open_order_32bit_auditctl_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_32bit_a20100_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_a20100_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_32bit_a201003_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_a201003_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_nofilter_32bit_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_arufm_open_order_32bit_open_auditctl_eperm_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_32bit_a20100_eperm_auditctl" />
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_32bit_a201003_eperm_auditctl" />
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_nofilter_32bit_eperm_auditctl" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="Test order of audit 32bit auditctl eperm rules order" id="test_arufm_open_order_32bit_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_order_32bit_eperm_auditctl" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_32bit_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_arufm_open_order_32bit_open_auditctl_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_64bit_a20100_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_a20100_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_64bit_a201003_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_a201003_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_nofilter_64bit_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_arufm_open_order_64bit_auditctl_eacces_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_64bit_a20100_eacces_auditctl" />
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_64bit_a201003_eacces_auditctl" />
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_nofilter_64bit_eacces_auditctl" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_order_64bit_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_order_64bit_eacces_auditctl" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_64bit_eacces_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_arufm_open_order_64bit_auditctl_eacces_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_64bit_a20100_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_a20100_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_64bit_a201003_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_a201003_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_nofilter_64bit_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ <local_variable id="var_arufm_open_order_64bit_open_auditctl_eperm_regex" version="1" datatype="string" comment="arches to audit">
|
|
|
7629ac |
+ <concat>
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_64bit_a20100_eperm_auditctl" />
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_64bit_a201003_eperm_auditctl" />
|
|
|
7629ac |
+ <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
|
|
|
7629ac |
+ <object_component item_field="text" object_ref="object_arufm_open_order_nofilter_64bit_eperm_auditctl" />
|
|
|
7629ac |
+ </concat>
|
|
|
7629ac |
+ </local_variable>
|
|
|
7629ac |
+
|
|
|
7629ac |
+ comment="defined audit rule must exist" id="test_arufm_open_order_64bit_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:object object_ref="object_arufm_open_order_64bit_eperm_auditctl" />
|
|
|
7629ac |
+ </ind:textfilecontent54_test>
|
|
|
7629ac |
+ <ind:textfilecontent54_object id="object_arufm_open_order_64bit_eperm_auditctl" version="1">
|
|
|
7629ac |
+ <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match" var_ref="var_arufm_open_order_64bit_open_auditctl_eperm_regex" />
|
|
|
7629ac |
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
|
|
|
7629ac |
+ </ind:textfilecontent54_object>
|
|
|
7629ac |
+
|
|
|
7629ac |
+</def-group>
|
|
|
7629ac |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_rule_order.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_rule_order.rule
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000000..60a1b9de12
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_rule_order.rule
|
|
|
7629ac |
@@ -0,0 +1,64 @@
|
|
|
7629ac |
+documentation_complete: true
|
|
|
7629ac |
+
|
|
|
7629ac |
+prodtype: rhel7,fedora
|
|
|
7629ac |
+
|
|
|
7629ac |
+title: 'Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly'
|
|
|
7629ac |
+
|
|
|
7629ac |
+description: |-
|
|
|
7629ac |
+ The audit system should collect detailed unauthorized file
|
|
|
7629ac |
+ accesses for all users and root.
|
|
|
7629ac |
+ To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access
|
|
|
7629ac |
+ of files via <tt>open</tt> syscall the audit rules collecting these events need to be in certain order.
|
|
|
7629ac |
+ The more specific rules need to come before the less specific rules. The reason for that is that more
|
|
|
7629ac |
+ specific rules cover a subset of events covered in the less specific rules, thus, they need to come
|
|
|
7629ac |
+ before to not be overshadowed by less specific rules, which match a bigger set of events.
|
|
|
7629ac |
+ Make sure that rules for unsuccessful calls of <tt>open</tt> syscall are in the order shown below.
|
|
|
7629ac |
+ If the <tt>auditd</tt> daemon is configured to use the <tt>augenrules</tt>
|
|
|
7629ac |
+ program to read audit rules during daemon startup (the default), check the order of
|
|
|
7629ac |
+ rules below in a file with suffix <tt>.rules</tt> in the directory
|
|
|
7629ac |
+ <tt>/etc/audit/rules.d</tt>.
|
|
|
7629ac |
+ If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
|
|
|
7629ac |
+ utility to read audit rules during daemon startup, check the order of rules below in
|
|
|
7629ac |
+ <tt>/etc/audit/audit.rules</tt> file.
|
|
|
7629ac |
+
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S open -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S open -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S open -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S open -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
|
|
|
7629ac |
+
|
|
|
7629ac |
+ If the system is 64 bit then also add the following lines:
|
|
|
7629ac |
+
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S open -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S open -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S open -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S open -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
|
|
|
7629ac |
+
|
|
|
7629ac |
+
|
|
|
7629ac |
+rationale: |-
|
|
|
7629ac |
+ Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
|
|
|
7629ac |
+ these events could serve as evidence of potential system compromise.
|
|
|
7629ac |
+
|
|
|
7629ac |
+severity: medium
|
|
|
7629ac |
+
|
|
|
7629ac |
+references:
|
|
|
7629ac |
+ cis: 5.2.10
|
|
|
7629ac |
+ cui: 3.1.7
|
|
|
7629ac |
+ disa: 172,2884
|
|
|
7629ac |
+ hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
|
|
|
7629ac |
+ nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
|
|
|
7629ac |
+ ospp@rhel7: FAU_GEN.1.1.c
|
|
|
7629ac |
+ pcidss: Req-10.2.4,Req-10.2.1
|
|
|
7629ac |
+ srg: SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205,SRG-OS-000392-GPOS-00172
|
|
|
7629ac |
+
|
|
|
7629ac |
+{{{ complete_ocil_entry_audit_syscall(syscall="open") }}}
|
|
|
7629ac |
+
|
|
|
7629ac |
+warnings:
|
|
|
7629ac |
+ - general: |-
|
|
|
7629ac |
+ Note that these rules can be configured in a
|
|
|
7629ac |
+ number of ways while still achieving the desired effect. Here the system calls
|
|
|
7629ac |
+ have been placed independent of other system calls. Grouping these system
|
|
|
7629ac |
+ calls with others as identifying earlier in this guide is more efficient.
|
|
|
7629ac |
diff --git a/shared/templates/template_OVAL_audit_rules_unsuccessful_file_modification b/shared/templates/template_OVAL_audit_rules_unsuccessful_file_modification
|
|
|
7629ac |
index 555375c757..36e255c28a 100644
|
|
|
7629ac |
--- a/shared/templates/template_OVAL_audit_rules_unsuccessful_file_modification
|
|
|
7629ac |
+++ b/shared/templates/template_OVAL_audit_rules_unsuccessful_file_modification
|
|
|
7629ac |
@@ -51,7 +51,7 @@
|
|
|
7629ac |
</ind:textfilecontent54_test>
|
|
|
7629ac |
<ind:textfilecontent54_object id="object_32bit_arufm_eacces_{{{ NAME }}}_augenrules" version="1">
|
|
|
7629ac |
<ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
- <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>={{{ auid }}}[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,])))[\S]*[\s]*(?!.*-F\s+a2&)[\s]+(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>={{{ auid }}}[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
|
|
|
7629ac |
<ind:instance datatype="int">1</ind:instance>
|
|
|
7629ac |
</ind:textfilecontent54_object>
|
|
|
7629ac |
|
|
|
7629ac |
@@ -60,7 +60,7 @@
|
|
|
7629ac |
</ind:textfilecontent54_test>
|
|
|
7629ac |
<ind:textfilecontent54_object id="object_32bit_arufm_eperm_{{{ NAME }}}_augenrules" version="1">
|
|
|
7629ac |
<ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
- <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>={{{ auid }}}[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,])))[\S]*[\s]*(?!.*-F\s+a2&)[\s]+(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>={{{ auid }}}[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
|
|
|
7629ac |
<ind:instance datatype="int">1</ind:instance>
|
|
|
7629ac |
</ind:textfilecontent54_object>
|
|
|
7629ac |
|
|
|
7629ac |
@@ -69,7 +69,7 @@
|
|
|
7629ac |
</ind:textfilecontent54_test>
|
|
|
7629ac |
<ind:textfilecontent54_object id="object_64bit_arufm_eacces_{{{ NAME }}}_augenrules" version="1">
|
|
|
7629ac |
<ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
- <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>={{{ auid }}}[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,])))[\S]*[\s]*(?!.*-F\s+a2&)[\s]+(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>={{{ auid }}}[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
|
|
|
7629ac |
<ind:instance datatype="int">1</ind:instance>
|
|
|
7629ac |
</ind:textfilecontent54_object>
|
|
|
7629ac |
|
|
|
7629ac |
@@ -78,7 +78,7 @@
|
|
|
7629ac |
</ind:textfilecontent54_test>
|
|
|
7629ac |
<ind:textfilecontent54_object id="object_64bit_arufm_eperm_{{{ NAME }}}_augenrules" version="1">
|
|
|
7629ac |
<ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
|
|
|
7629ac |
- <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>={{{ auid }}}[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,])))[\S]*[\s]*(?!.*-F\s+a2&)[\s]+(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>={{{ auid }}}[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
|
|
|
7629ac |
<ind:instance datatype="int">1</ind:instance>
|
|
|
7629ac |
</ind:textfilecontent54_object>
|
|
|
7629ac |
|
|
|
7629ac |
@@ -87,7 +87,7 @@
|
|
|
7629ac |
</ind:textfilecontent54_test>
|
|
|
7629ac |
<ind:textfilecontent54_object id="object_32bit_arufm_eacces_{{{ NAME }}}_auditctl" version="1">
|
|
|
7629ac |
<ind:filepath>/etc/audit/audit.rules</ind:filepath>
|
|
|
7629ac |
- <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>={{{ auid }}}[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,])))[\S]*[\s]*(?!.*-F\s+a2&)[\s]+(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>={{{ auid }}}[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
|
|
|
7629ac |
<ind:instance datatype="int">1</ind:instance>
|
|
|
7629ac |
</ind:textfilecontent54_object>
|
|
|
7629ac |
|
|
|
7629ac |
@@ -96,7 +96,7 @@
|
|
|
7629ac |
</ind:textfilecontent54_test>
|
|
|
7629ac |
<ind:textfilecontent54_object id="object_32bit_arufm_eperm_{{{ NAME }}}_auditctl" version="1">
|
|
|
7629ac |
<ind:filepath>/etc/audit/audit.rules</ind:filepath>
|
|
|
7629ac |
- <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>={{{ auid }}}[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,])))[\S]*[\s]*(?!.*-F\s+a2&)[\s]+(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>={{{ auid }}}[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
|
|
|
7629ac |
<ind:instance datatype="int">1</ind:instance>
|
|
|
7629ac |
</ind:textfilecontent54_object>
|
|
|
7629ac |
|
|
|
7629ac |
@@ -105,7 +105,7 @@
|
|
|
7629ac |
</ind:textfilecontent54_test>
|
|
|
7629ac |
<ind:textfilecontent54_object id="object_64bit_arufm_eacces_{{{ NAME }}}_auditctl" version="1">
|
|
|
7629ac |
<ind:filepath>/etc/audit/audit.rules</ind:filepath>
|
|
|
7629ac |
- <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>={{{ auid }}}[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,])))[\S]*[\s]*(?!.*-F\s+a2&)[\s]+(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>={{{ auid }}}[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
|
|
|
7629ac |
<ind:instance datatype="int">1</ind:instance>
|
|
|
7629ac |
</ind:textfilecontent54_object>
|
|
|
7629ac |
|
|
|
7629ac |
@@ -114,7 +114,7 @@
|
|
|
7629ac |
</ind:textfilecontent54_test>
|
|
|
7629ac |
<ind:textfilecontent54_object id="object_64bit_arufm_eperm_{{{ NAME }}}_auditctl" version="1">
|
|
|
7629ac |
<ind:filepath>/etc/audit/audit.rules</ind:filepath>
|
|
|
7629ac |
- <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>={{{ auid }}}[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
|
|
|
7629ac |
+ <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,])))[\S]*[\s]*(?!.*-F\s+a2&)[\s]+(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>={{{ auid }}}[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
|
|
|
7629ac |
<ind:instance datatype="int">1</ind:instance>
|
|
|
7629ac |
</ind:textfilecontent54_object>
|
|
|
7629ac |
|