From 1f53aae9b711466ce3d8f5d72d544c16024b6f7f Mon Sep 17 00:00:00 2001

From: Vojtech Polasek <vpolasek@redhat.com>

Date: Fri, 8 Jul 2022 13:21:36 +0200

Subject: [PATCH 01/18] add ppc64le applicability platform

---

 shared/applicability/arch.yml                 |  6 ++++

 ...proc_sys_kernel_osrelease_arch_ppc64le.xml | 33 +++++++++++++++++++

 2 files changed, 39 insertions(+)

 create mode 100644 shared/checks/oval/proc_sys_kernel_osrelease_arch_ppc64le.xml

diff --git a/shared/applicability/arch.yml b/shared/applicability/arch.yml

index cb64a037192..1223001846a 100644

--- a/shared/applicability/arch.yml

+++ b/shared/applicability/arch.yml

@@ -28,3 +28,9 @@ cpes:

       bash_conditional: 'grep -q aarch64 /proc/sys/kernel/osrelease'

       ansible_conditional: 'ansible_architecture == "aarch64"'

+  - ppc64le_arch:

+      name: "cpe:/a:ppc64le_arch"

+      title: "System architecture is ppc64le"

+      check_id: proc_sys_kernel_osrelease_arch_ppc64le

+      bash_conditional: 'grep -q ppc64le /proc/sys/kernel/osrelease'

+      ansible_conditional: 'ansible_architecture == "ppc64le"'

diff --git a/shared/checks/oval/proc_sys_kernel_osrelease_arch_ppc64le.xml b/shared/checks/oval/proc_sys_kernel_osrelease_arch_ppc64le.xml

new file mode 100644

index 00000000000..058de0db5e7

--- /dev/null

+++ b/shared/checks/oval/proc_sys_kernel_osrelease_arch_ppc64le.xml

@@ -0,0 +1,33 @@

+<def-group>

+  

+  version="1">

+    <metadata>

+      <title>Test that the architecture is ppc64le</title>

+      <affected family="unix">

+        <platform>multi_platform_all</platform>

+      </affected>

+      <description>Check that architecture of kernel in /proc/sys/kernel/osrelease is ppc64le</description>

+    </metadata>

+    <criteria>

+      

+      test_ref="test_proc_sys_kernel_osrelease_arch_ppc64le" />

+    </criteria>

+  </definition>

+  

+      comment="proc_sys_kernel is for ppc64le architecture"

+      id="test_proc_sys_kernel_osrelease_arch_ppc64le"

+  version="1">

+    <ind:object object_ref="object_proc_sys_kernel_osrelease_arch_ppc64le" />

+    <ind:state state_ref="state_proc_sys_kernel_osrelease_arch_ppc64le" />

+  </ind:textfilecontent54_test>

+

+  <ind:textfilecontent54_object id="object_proc_sys_kernel_osrelease_arch_ppc64le" version="1">

+    <ind:filepath>/proc/sys/kernel/osrelease</ind:filepath>

+    <ind:pattern operation="pattern match">^.*\.(.*)$</ind:pattern>

+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>

+  </ind:textfilecontent54_object>

+

+  <ind:textfilecontent54_state id="state_proc_sys_kernel_osrelease_arch_ppc64le" version="1">

+    <ind:subexpression datatype="string" operation="pattern match">^ppc64le$</ind:subexpression>

+  </ind:textfilecontent54_state>

+</def-group>

From ced2b8699637af0f75786bd07f2944a6febaa531 Mon Sep 17 00:00:00 2001

From: Vojtech Polasek <vpolasek@redhat.com>

Date: Fri, 8 Jul 2022 13:46:47 +0200

Subject: [PATCH 02/18] add audit_access_failed_ppc64le

---

 .../policy_rules/audit_access_failed/rule.yml |  2 +-

 .../kubernetes/shared.yml                     | 15 ++++++

 .../audit_access_failed_ppc64le/rule.yml      | 54 +++++++++++++++++++

 3 files changed, 70 insertions(+), 1 deletion(-)

 create mode 100644 linux_os/guide/system/auditing/policy_rules/audit_access_failed_ppc64le/kubernetes/shared.yml

 create mode 100644 linux_os/guide/system/auditing/policy_rules/audit_access_failed_ppc64le/rule.yml

diff --git a/linux_os/guide/system/auditing/policy_rules/audit_access_failed/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_access_failed/rule.yml

index 87fc33ad041..74f92b94762 100644

--- a/linux_os/guide/system/auditing/policy_rules/audit_access_failed/rule.yml

+++ b/linux_os/guide/system/auditing/policy_rules/audit_access_failed/rule.yml

@@ -28,7 +28,7 @@ rationale: |-

 # so do not apply this rule but apply the specific one instead

 {{% if product == "rhel9" %}}

 platforms:

-    - not aarch64_arch

+    - not aarch64_arch and not ppc64le_arch

 {{% endif %}}

 identifiers:

diff --git a/linux_os/guide/system/auditing/policy_rules/audit_access_failed_ppc64le/kubernetes/shared.yml b/linux_os/guide/system/auditing/policy_rules/audit_access_failed_ppc64le/kubernetes/shared.yml

new file mode 100644

index 00000000000..412c67f15a1

--- /dev/null

+++ b/linux_os/guide/system/auditing/policy_rules/audit_access_failed_ppc64le/kubernetes/shared.yml

@@ -0,0 +1,15 @@

+---

+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos

+apiVersion: machineconfiguration.openshift.io/v1

+kind: MachineConfig

+spec:

+  config:

+    ignition:

+      version: 3.1.0

+    storage:

+      files:

+      - contents:

+          source: data:,%23%23%20Unsuccessful%20file%20access%20%28any%20other%20opens%29%20This%20has%20to%20go%20last.%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Copenat%2Copenat2%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Copenat%2Copenat2%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-access%0A

+        mode: 0600

+        path: /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules

+        overwrite: true

diff --git a/linux_os/guide/system/auditing/policy_rules/audit_access_failed_ppc64le/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_access_failed_ppc64le/rule.yml

new file mode 100644

index 00000000000..f764da506e9

--- /dev/null

+++ b/linux_os/guide/system/auditing/policy_rules/audit_access_failed_ppc64le/rule.yml

@@ -0,0 +1,54 @@

+documentation_complete: true

+

+prodtype: ol8,ol9,rhcos4,rhel8,rhel9

+

+title: 'Configure auditing of unsuccessful file accesses (ppc64le)'

+

+{{% set file_contents_audit_access_failed =

+"## Unsuccessful file access (any other opens) This has to go last.

+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access

+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access" %}}

+

+description: |-

+    Ensure that unsuccessful attempts to access a file are audited.

+

+    The following rules configure audit as described above:

+    
{{{ file_contents_audit_access_failed|indent }}}    

+

+    Load new Audit rules into kernel by running:

+    
augenrules --load

+

+    Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.

+

+rationale: |-

+    Unsuccessful attempts to access a file might be signs of malicious activity happening within the system. Auditing of such activities helps in their monitoring and investigation.

+

+severity: medium

+

+platforms:

+    - ppc64le_arch

+

+identifiers:

+    cce@rhel8: CCE-85953-8

+    cce@rhel9: CCE-85955-3

+

+references:

+    ism: 0582,0584,05885,0586,0846,0957

+    nist: AU-2(a)

+    ospp: FAU_GEN.1.1.c

+    srg: SRG-OS-000458-GPOS-00203,SRG-OS-000474-GPOS-00219,SRG-OS-000475-GPOS-00220,SRG-OS-000463-GPOS-00207,SRG-OS-000465-GPOS-00209,SRG-OS-000461-GPOS-00205

+

+ocil_clause: 'the file does not exist or the content differs'

+

+ocil: |-

+    To verify that the <tt>Audit</tt> is correctly configured according to recommended rules, check the content of the file with the following command:

+    
cat /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules

+    The output has to be exactly as follows:

+    
{{{ file_contents_audit_access_failed|indent }}}    

+

+template:

+    name: audit_file_contents

+    vars:

+        filepath: /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules

+        contents: |-

+            {{{ file_contents_audit_access_failed|indent(12) }}}

From 6c9b276ce50932934afa4e1af38ee5cd88166580 Mon Sep 17 00:00:00 2001

From: Vojtech Polasek <vpolasek@redhat.com>

Date: Fri, 8 Jul 2022 13:56:29 +0200

Subject: [PATCH 03/18] add audit_access_success ppc64le

---

 .../audit_access_success/rule.yml             |  2 +-

 .../kubernetes/shared.yml                     | 15 ++++++

 .../audit_access_success_ppc64le/rule.yml     | 54 +++++++++++++++++++

 3 files changed, 70 insertions(+), 1 deletion(-)

 create mode 100644 linux_os/guide/system/auditing/policy_rules/audit_access_success_ppc64le/kubernetes/shared.yml

 create mode 100644 linux_os/guide/system/auditing/policy_rules/audit_access_success_ppc64le/rule.yml

diff --git a/linux_os/guide/system/auditing/policy_rules/audit_access_success/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_access_success/rule.yml

index 284ed1756ff..7646d5f9f4b 100644

--- a/linux_os/guide/system/auditing/policy_rules/audit_access_success/rule.yml

+++ b/linux_os/guide/system/auditing/policy_rules/audit_access_success/rule.yml

@@ -27,7 +27,7 @@ rationale: |-

 # so do not apply this rule but apply the specific one instead

 {{% if product == "rhel9" %}}

 platforms:

-    - not aarch64_arch

+    - not aarch64_arch and not ppc64le_arch

 {{% endif %}}

 identifiers:

diff --git a/linux_os/guide/system/auditing/policy_rules/audit_access_success_ppc64le/kubernetes/shared.yml b/linux_os/guide/system/auditing/policy_rules/audit_access_success_ppc64le/kubernetes/shared.yml

new file mode 100644

index 00000000000..372b7c27c76

--- /dev/null

+++ b/linux_os/guide/system/auditing/policy_rules/audit_access_success_ppc64le/kubernetes/shared.yml

@@ -0,0 +1,15 @@

+---

+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos

+apiVersion: machineconfiguration.openshift.io/v1

+kind: MachineConfig

+spec:

+  config:

+    ignition:

+      version: 3.1.0

+    storage:

+      files:

+      - contents:

+          source: data:,%23%23%20Successful%20file%20access%20%28any%20other%20opens%29%20This%20has%20to%20go%20last.%0A%23%23%20These%20next%20two%20are%20likely%20to%20result%20in%20a%20whole%20lot%20of%20events%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Copenat%2Copenat2%2Copen_by_handle_at%20-F%20success%3D1%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dsuccessful-access%0A

+        mode: 0600

+        path: /etc/audit/rules.d/30-ospp-v42-3-access-success.rules

+        overwrite: true

diff --git a/linux_os/guide/system/auditing/policy_rules/audit_access_success_ppc64le/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_access_success_ppc64le/rule.yml

new file mode 100644

index 00000000000..b76fe0b4a4e

--- /dev/null

+++ b/linux_os/guide/system/auditing/policy_rules/audit_access_success_ppc64le/rule.yml

@@ -0,0 +1,54 @@

+documentation_complete: true

+

+prodtype: ol8,ol9,rhcos4,rhel8,rhel9

+

+title: 'Configure auditing of successful file accesses (ppc64le)'

+

+{{% set file_contents_audit_access_success =

+"## Successful file access (any other opens) This has to go last.

+## These next two are likely to result in a whole lot of events

+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access" %}}

+

+description: |-

+    Ensure that successful attempts to access a file are audited.

+

+    The following rules configure audit as described above:

+    
{{{ file_contents_audit_access_success|indent }}}    

+

+    Load new Audit rules into kernel by running:

+    
augenrules --load

+

+    Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.

+

+rationale: |-

+    Auditing of successful attempts to access a file helps in investigation of activities performed on the system.

+

+severity: medium

+

+platforms:

+    - ppc64le_arch

+

+identifiers:

+    cce@rhel8: CCE-85960-3

+    cce@rhel9: CCE-85961-1

+

+references:

+    ism: 0582,0584,05885,0586,0846,0957

+    nist: AU-2(a)

+    ospp: FAU_GEN.1.1.c

+    srg: SRG-OS-000458-GPOS-00203,SRG-OS-000474-GPOS-00219,SRG-OS-000475-GPOS-00220,SRG-OS-000463-GPOS-00207,SRG-OS-000465-GPOS-00209,SRG-OS-000461-GPOS-00205

+

+ocil_clause: 'the file does not exist or the content differs'

+

+ocil: |-

+    To verify that the <tt>Audit</tt> is correctly configured according to recommended rules, check the content of the file with the following command:

+    
cat /etc/audit/rules.d/30-ospp-v42-3-access-success.rules

+    The output has to be exactly as follows:

+    
{{{ file_contents_audit_access_success|indent }}}    

+

+template:

+    name: audit_file_contents

+    vars:

+        filepath: /etc/audit/rules.d/30-ospp-v42-3-access-success.rules

+        contents: |-

+            {{{ file_contents_audit_access_success|indent(12) }}}

From 7a343648d9e206a1b981f4235daeb9dd3cd475dc Mon Sep 17 00:00:00 2001

From: Vojtech Polasek <vpolasek@redhat.com>

Date: Fri, 8 Jul 2022 14:01:03 +0200

Subject: [PATCH 04/18] add audit_create_failed ppc64le

---

 .../policy_rules/audit_create_failed/rule.yml |  2 +-

 .../kubernetes/shared.yml                     | 15 +++++

 .../audit_create_failed_ppc64le/rule.yml      | 57 +++++++++++++++++++

 3 files changed, 73 insertions(+), 1 deletion(-)

 create mode 100644 linux_os/guide/system/auditing/policy_rules/audit_create_failed_ppc64le/kubernetes/shared.yml

 create mode 100644 linux_os/guide/system/auditing/policy_rules/audit_create_failed_ppc64le/rule.yml

diff --git a/linux_os/guide/system/auditing/policy_rules/audit_create_failed/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_create_failed/rule.yml

index f4da514e080..ac5e1f97413 100644

--- a/linux_os/guide/system/auditing/policy_rules/audit_create_failed/rule.yml

+++ b/linux_os/guide/system/auditing/policy_rules/audit_create_failed/rule.yml

@@ -36,7 +36,7 @@ rationale: |-

 # so do not apply this rule but apply the specific one instead

 {{% if product == "rhel9" %}}

 platforms:

-    - not aarch64_arch

+    - not aarch64_arch and not ppc64le_arch

 {{% endif %}}

 identifiers:

diff --git a/linux_os/guide/system/auditing/policy_rules/audit_create_failed_ppc64le/kubernetes/shared.yml b/linux_os/guide/system/auditing/policy_rules/audit_create_failed_ppc64le/kubernetes/shared.yml

new file mode 100644

index 00000000000..08c8dc85507

--- /dev/null

+++ b/linux_os/guide/system/auditing/policy_rules/audit_create_failed_ppc64le/kubernetes/shared.yml

@@ -0,0 +1,15 @@

+---

+# platform = multi_platform_rhel,multi_platform_fedora

+apiVersion: machineconfiguration.openshift.io/v1

+kind: MachineConfig

+spec:

+  config:

+    ignition:

+      version: 3.1.0

+    storage:

+      files:

+      - contents:

+          source: data:,%23%23%20Unsuccessful%20file%20creation%20%28open%20with%20O_CREAT%29%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-create%0A

+        mode: 0600

+        path: /etc/audit/rules.d/30-ospp-v42-1-create-failed.rules 

+        overwrite: true

diff --git a/linux_os/guide/system/auditing/policy_rules/audit_create_failed_ppc64le/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_create_failed_ppc64le/rule.yml

new file mode 100644

index 00000000000..ead598f8b9a

--- /dev/null

+++ b/linux_os/guide/system/auditing/policy_rules/audit_create_failed_ppc64le/rule.yml

@@ -0,0 +1,57 @@

+documentation_complete: true

+

+prodtype: ol8,ol9,rhcos4,rhel8,rhel9

+

+title: 'Configure auditing of unsuccessful file creations (ppc64le)'

+

+{{% set file_contents_audit_create_failed =

+"## Unsuccessful file creation (open with O_CREAT)

+-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create

+-a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create

+-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create

+-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create

+-a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create

+-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create" %}}

+

+description: |-

+    Ensure that unsuccessful attempts to create a file are audited.

+

+    The following rules configure audit as described above:

+    
{{{ file_contents_audit_create_failed|indent }}}    

+

+    Load new Audit rules into kernel by running:

+    
augenrules --load

+

+    Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.

+

+rationale: |-

+    Unsuccessful file creations might be a sign of a malicious action being performed on the system. Keeping log of such events helps in monitoring and investigation of such actions.

+

+severity: medium

+

+platforms:

+    - ppc64le_arch

+

+identifiers:

+    cce@rhel8: CCE-85962-9

+    cce@rhel9: CCE-85965-2

+

+references:

+    nist: AU-2(a)

+    ospp: FAU_GEN.1.1.c

+    srg: SRG-OS-000458-GPOS-00203,SRG-OS-000474-GPOS-00219,SRG-OS-000475-GPOS-00220,SRG-OS-000463-GPOS-00207,SRG-OS-000465-GPOS-00209,SRG-OS-000461-GPOS-00205

+

+ocil_clause: 'the file does not exist or the content differs'

+

+ocil: |-

+    To verify that the <tt>Audit</tt> is correctly configured according to recommended rules, check the content of the file with the following command:

+    
cat /etc/audit/rules.d/30-ospp-v42-1-create-failed.rules

+    The output has to be exactly as follows:

+    
{{{ file_contents_audit_create_failed|indent }}}    

+

+template:

+    name: audit_file_contents

+    vars:

+        filepath: /etc/audit/rules.d/30-ospp-v42-1-create-failed.rules

+        contents: |-

+            {{{ file_contents_audit_create_failed|indent(12) }}}

From c433196a29cfcf5b3dca2f3cde7dc230f43a181e Mon Sep 17 00:00:00 2001

From: Vojtech Polasek <vpolasek@redhat.com>

Date: Fri, 8 Jul 2022 14:03:38 +0200

Subject: [PATCH 05/18] add audit_create_success ppc64le

---

 .../audit_create_success/rule.yml             |  2 +-

 .../audit_create_success_ppc64le/rule.yml     | 54 +++++++++++++++++++

 2 files changed, 55 insertions(+), 1 deletion(-)

 create mode 100644 linux_os/guide/system/auditing/policy_rules/audit_create_success_ppc64le/rule.yml

diff --git a/linux_os/guide/system/auditing/policy_rules/audit_create_success/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_create_success/rule.yml

index 43e8674178b..21e71077030 100644

--- a/linux_os/guide/system/auditing/policy_rules/audit_create_success/rule.yml

+++ b/linux_os/guide/system/auditing/policy_rules/audit_create_success/rule.yml

@@ -30,7 +30,7 @@ rationale: |-

 # so do not apply this rule but apply the specific one instead

 {{% if product == "rhel9" %}}

 platforms:

-    - not aarch64_arch

+    - not aarch64_arch and not ppc64le_arch

 {{% endif %}}

 identifiers:

new file mode 100644

index 00000000000..294947c14ba

--- /dev/null

+++ b/linux_os/guide/system/auditing/policy_rules/audit_create_success_ppc64le/rule.yml

@@ -0,0 +1,54 @@

+documentation_complete: true

+

+prodtype: ol8,ol9,rhcos4,rhel8,rhel9

+

+title: 'Configure auditing of successful file creations (ppc64le)'

+

+{{% set file_contents_audit_create_success =

+"## Successful file creation (open with O_CREAT)

+-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create

+-a always,exit -F arch=b64 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create

+-a always,exit -F arch=b64 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create" %}}

+

+description: |-

+    Ensure that successful attempts to create a file are audited.

+

+    The following rules configure audit as described above:

+    
{{{ file_contents_audit_create_success |indent }}}    

+

+    Load new Audit rules into kernel by running:

+    
augenrules --load

+

+    Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.

+

+rationale: |-

+    Auditing of successful attempts to create a file helps in investigation of actions which happened on the system.

+

+severity: medium

+

+platforms:

+    - ppc64le_arch

+

+identifiers:

+    cce@rhel8: CCE-85966-0

+    cce@rhel9: CCE-85968-6

+

+references:

+    nist: AU-2(a)

+    ospp: FAU_GEN.1.1.c

+    srg: SRG-OS-000458-GPOS-00203,SRG-OS-000474-GPOS-00219,SRG-OS-000475-GPOS-00220,SRG-OS-000463-GPOS-00207,SRG-OS-000465-GPOS-00209,SRG-OS-000461-GPOS-00205

+

+ocil_clause: 'the file does not exist or the content differs'

+

+ocil: |-

+    To verify that the <tt>Audit</tt> is correctly configured according to recommended rules, check the content of the file with the following command:

+    
cat /etc/audit/rules.d/30-ospp-v42-1-create-success.rules

+    The output has to be exactly as follows:

+    
{{{ file_contents_audit_create_success|indent }}}    

+

+template:

+    name: audit_file_contents

+    vars:

+        filepath: /etc/audit/rules.d/30-ospp-v42-1-create-success.rules

+        contents: |-

+            {{{ file_contents_audit_create_success|indent(12) }}}

From d8593e7d56ed85f34f228b24526b703eed141071 Mon Sep 17 00:00:00 2001

From: Vojtech Polasek <vpolasek@redhat.com>

Date: Fri, 8 Jul 2022 14:07:50 +0200

Subject: [PATCH 06/18] add audit_delete_failed ppc64le

---

 .../policy_rules/audit_delete_failed/rule.yml |  2 +-

 .../kubernetes/shared.yml                     | 15 +++++

 .../audit_delete_failed_ppc64le/rule.yml      | 65 +++++++++++++++++++

 3 files changed, 81 insertions(+), 1 deletion(-)

 create mode 100644 linux_os/guide/system/auditing/policy_rules/audit_delete_failed_ppc64le/kubernetes/shared.yml

 create mode 100644 linux_os/guide/system/auditing/policy_rules/audit_delete_failed_ppc64le/rule.yml

diff --git a/linux_os/guide/system/auditing/policy_rules/audit_delete_failed/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_delete_failed/rule.yml

index 07ed41a9c4f..5ac68376970 100644

--- a/linux_os/guide/system/auditing/policy_rules/audit_delete_failed/rule.yml

+++ b/linux_os/guide/system/auditing/policy_rules/audit_delete_failed/rule.yml

@@ -28,7 +28,7 @@ rationale: |-

 # so do not apply this rule but apply the specific one instead

 {{% if product == "rhel9" %}}

 platforms:

-    - not aarch64_arch

+    - not aarch64_arch and not ppc64le_arch

 {{% endif %}}

 identifiers:

diff --git a/linux_os/guide/system/auditing/policy_rules/audit_delete_failed_ppc64le/kubernetes/shared.yml b/linux_os/guide/system/auditing/policy_rules/audit_delete_failed_ppc64le/kubernetes/shared.yml

new file mode 100644

index 00000000000..2fb2c25aa30

--- /dev/null

+++ b/linux_os/guide/system/auditing/policy_rules/audit_delete_failed_ppc64le/kubernetes/shared.yml

@@ -0,0 +1,15 @@

+---

+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos

+apiVersion: machineconfiguration.openshift.io/v1

+kind: MachineConfig

+spec:

+  config:

+    ignition:

+      version: 3.1.0

+    storage:

+      files:

+      - contents:

+          source: data:,%23%23%20Unsuccessful%20file%20delete%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20unlink%2Cunlinkat%2Crename%2Crenameat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-delete%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20unlink%2Cunlinkat%2Crename%2Crenameat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-delete

+        mode: 0600

+        path: /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules

+        overwrite: true

diff --git a/linux_os/guide/system/auditing/policy_rules/audit_delete_failed_ppc64le/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_delete_failed_ppc64le/rule.yml

new file mode 100644

index 00000000000..c8c532cb3bb

--- /dev/null

+++ b/linux_os/guide/system/auditing/policy_rules/audit_delete_failed_ppc64le/rule.yml

@@ -0,0 +1,65 @@

+documentation_complete: true

+

+prodtype: ol8,ol9,rhcos4,rhel8,rhel9

+

+title: 'Configure auditing of unsuccessful file deletions (ppc64le)'

+

+{{% set file_contents_audit_delete_failed =

+"## Unsuccessful file delete

+-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete

+-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete" %}}

+

+description: |-

+    Ensure that unsuccessful attempts to delete a file are audited.

+

+    The following rules configure audit as described above:

+    
{{{ file_contents_audit_delete_failed|indent }}}    

+

+    Load new Audit rules into kernel by running:

+    
augenrules --load

+

+    Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.

+

+rationale: |-

+    Unsuccessful attempts to delete a file might be signs of malicious activities. Auditing of such events help in monitoring and investigating of such activities.

+

+severity: medium

+

+platforms:

+    - ppc64le_arch

+

+identifiers:

+    cce@rhel8: CCE-85969-4

+    cce@rhel9: CCE-85970-2

+

+references:

+    nist: AU-2(a)

+    ospp: FAU_GEN.1.1.c

+    srg: SRG-OS-000458-GPOS-00203,SRG-OS-000474-GPOS-00219,SRG-OS-000475-GPOS-00220,SRG-OS-000463-GPOS-00207,SRG-OS-000465-GPOS-00209,SRG-OS-000461-GPOS-00205,SRG-OS-000468-GPOS-00212

+

+ocil_clause: 'the file does not exist or the content differs'

+

+ocil: |-

+    To verify that the <tt>Audit</tt> is correctly configured according to recommended rules, check the content of the file with the following command:

+    
cat /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules

+    The output has to be exactly as follows:

+    
{{{ file_contents_audit_delete_failed|indent }}}    

+

+template:

+    name: audit_file_contents

+    vars:

+        filepath: /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules

+        contents: |-

+            {{{ file_contents_audit_delete_failed|indent(12) }}}

+

+fixtext: |-

+    Configure {{{ full_name }}} to audit all unsuccessful attempts to delete a file.

+

+    Create file "/etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules" with the exactly following content:

+

+    {{{ file_contents_audit_delete_failed|indent(4) }}}

+

+    Then, run the following commands:

+

+    $ sudo chmod o-rwx /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules

+    $ sudo augenrules --load

From 364e30b710df1f58a004edce60cfc6043d0aed3b Mon Sep 17 00:00:00 2001

From: Vojtech Polasek <vpolasek@redhat.com>

Date: Fri, 8 Jul 2022 14:12:20 +0200

Subject: [PATCH 07/18] add audit_delete_success ppc64le

---

 .../audit_delete_success/rule.yml             |  2 +-

 .../kubernetes/shared.yml                     |  7 ++

 .../audit_delete_success_ppc64le/rule.yml     | 64 +++++++++++++++++++

 3 files changed, 72 insertions(+), 1 deletion(-)

 create mode 100644 linux_os/guide/system/auditing/policy_rules/audit_delete_success_ppc64le/kubernetes/shared.yml

 create mode 100644 linux_os/guide/system/auditing/policy_rules/audit_delete_success_ppc64le/rule.yml

diff --git a/linux_os/guide/system/auditing/policy_rules/audit_delete_success/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_delete_success/rule.yml

index 93b42e3f4d6..b2fc0cca348 100644

--- a/linux_os/guide/system/auditing/policy_rules/audit_delete_success/rule.yml

+++ b/linux_os/guide/system/auditing/policy_rules/audit_delete_success/rule.yml

@@ -26,7 +26,7 @@ rationale: |-

 # so do not apply this rule but apply the specific one instead

 {{% if product == "rhel9" %}}

 platforms:

-    - not aarch64_arch

+    - not aarch64_arch and not ppc64le_arch

 {{% endif %}}

 identifiers:

diff --git a/linux_os/guide/system/auditing/policy_rules/audit_delete_success_ppc64le/kubernetes/shared.yml b/linux_os/guide/system/auditing/policy_rules/audit_delete_success_ppc64le/kubernetes/shared.yml

new file mode 100644

index 00000000000..3734328c9e1

--- /dev/null

+++ b/linux_os/guide/system/auditing/policy_rules/audit_delete_success_ppc64le/kubernetes/shared.yml

@@ -0,0 +1,7 @@

+---

+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos

+

+{{% set file_contents = """## Successful file delete

+-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete""" -%}}

+

+{{{- kubernetes_machine_config_file(path='/etc/audit/rules.d/30-ospp-v42-4-delete-success.rules', file_permissions_mode='0600', source=file_contents) }}}

diff --git a/linux_os/guide/system/auditing/policy_rules/audit_delete_success_ppc64le/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_delete_success_ppc64le/rule.yml

new file mode 100644

index 00000000000..35362051948

--- /dev/null

+++ b/linux_os/guide/system/auditing/policy_rules/audit_delete_success_ppc64le/rule.yml

@@ -0,0 +1,64 @@

+documentation_complete: true

+

+prodtype: ol8,ol9,rhcos4,rhel8,rhel9

+

+title: 'Configure auditing of successful file deletions (ppc64le)'

+

+{{% set file_contents_audit_delete_success =

+"## Successful file delete

+-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete" %}}

+

+description: |-

+    Ensure that successful attempts to delete a file are audited.

+

+    The following rules configure audit as described above:

+    
{{{ file_contents_audit_delete_success|indent }}}    

+

+    Load new Audit rules into kernel by running:

+    
augenrules --load

+

+    Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.

+

+rationale: |-

+    Auditing of successful attempts to delete a file may help in monitoring and investigation of activities performed on the system.

+

+severity: medium

+

+platforms:

+    - ppc64le_arch

+

+identifiers:

+    cce@rhel8: CCE-85974-4

+    cce@rhel9: CCE-85976-9

+

+references:

+    nist: AU-2(a)

+    ospp: FAU_GEN.1.1.c

+    srg: SRG-OS-000458-GPOS-00203,SRG-OS-000474-GPOS-00219,SRG-OS-000475-GPOS-00220,SRG-OS-000463-GPOS-00207,SRG-OS-000465-GPOS-00209,SRG-OS-000461-GPOS-00205,SRG-OS-000468-GPOS-00212

+

+ocil_clause: 'the file does not exist or the content differs'

+

+ocil: |-

+    To verify that the <tt>Audit</tt> is correctly configured according to recommended rules, check the content of the file with the following command:

+    
cat /etc/audit/rules.d/30-ospp-v42-4-delete-success.rules

+    The output has to be exactly as follows:

+    
{{{ file_contents_audit_delete_success|indent }}}    

+

+template:

+    name: audit_file_contents

+    vars:

+        filepath: /etc/audit/rules.d/30-ospp-v42-4-delete-success.rules

+        contents: |-

+            {{{ file_contents_audit_delete_success|indent(12) }}}

+

+fixtext: |-

+    Configure {{{ full_name }}} to audit all successful attempts to delete a file.

+

+    Create file "/etc/audit/rules.d/30-ospp-v42-4-delete-success.rules" with the exactly following content:

+

+    {{{ file_contents_audit_delete_success|indent(4) }}}

+

+    Then, run the following commands:

+

+    $ sudo chmod o-rwx /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules

+    $ sudo augenrules --load

From 3bb8799b634e8ec164a6ff7287df92e9519c1a47 Mon Sep 17 00:00:00 2001

From: Vojtech Polasek <vpolasek@redhat.com>

Date: Fri, 8 Jul 2022 14:16:37 +0200

Subject: [PATCH 08/18] add audit_modify_failed ppc64le

---

 .../policy_rules/audit_modify_failed/rule.yml |  2 +-

 .../kubernetes/shared.yml                     | 15 +++++

 .../audit_modify_failed_ppc64le/rule.yml      | 57 +++++++++++++++++++

 3 files changed, 73 insertions(+), 1 deletion(-)

 create mode 100644 linux_os/guide/system/auditing/policy_rules/audit_modify_failed_ppc64le/kubernetes/shared.yml

 create mode 100644 linux_os/guide/system/auditing/policy_rules/audit_modify_failed_ppc64le/rule.yml