From 66b01d9b55ee6b1d791383467827a6444673a51c Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Wed, 29 Apr 2020 18:36:39 +0200
Subject: [PATCH 1/6] Add fields arg to ansbile audit syscall macros
The field arg allows one to specify syscall fields for the audit rule.
These fields can be auid, exit, argument, or any field used by audit.
Reference:
https://github.com/linux-audit/audit-documentation/wiki/SPEC-Writing-Good-Events#field-names
---
shared/macros-ansible.jinja | 32 +++++++++++++++++++++++++-------
1 file changed, 25 insertions(+), 7 deletions(-)
diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja
index 03e4306051..7674c290fa 100644
--- a/shared/macros-ansible.jinja
+++ b/shared/macros-ansible.jinja
@@ -352,9 +352,11 @@ The macro requires following parameters:
- arch: an architecture to be used in the Audit rule (b32, b64)
- syscalls: list of syscalls supplied as a list ["syscall1", "syscall2"] etc.
- key: a key to use as rule identifier.
+- fields (optional): list of syscall fields to add (e.g.: auid=unset, exit=-EPERM, a0&0100);
+ Add them in the order you expect them to be in the audit rule.
Note that if there already exists a rule wit the same key in the /etc/audit/rules.d directory, the rule will be placed in the same file.
#}}
-{{% macro ansible_audit_augenrules_add_syscall_rule(arch="", syscalls=[], key="") -%}}
+{{% macro ansible_audit_augenrules_add_syscall_rule(arch="", syscalls=[], key="", fields=[]) -%}}
- name: Declare list of syscals
set_fact:
syscalls: {{{ syscalls }}}
@@ -362,10 +364,17 @@ Note that if there already exists a rule wit the same key in the /etc/audit/rul
- name: Declare number of syscalls
set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"
+{{# This dictionary is a Jinja2 trick to allow loops to change variables defined out of its scope #}}
+{{% set fields_data = { 'regex' : "", 'list': "" } %}}
+{{% for field in fields %}}
+ {{% set not_used = fields_data.update({'regex': fields_data.regex + '(?:-F\s+' + field + ')'}) %}}
+ {{% set not_used = fields_data.update({'list': fields_data.list+ ' -F ' + field }) %}}
+{{% endfor %}}
+
- name: Check existence of syscalls for architecture {{{ arch }}} in /etc/audit/rules.d/
find:
paths: "/etc/audit/rules.d"
- contains: '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch={{{ arch }}}[\s]+)(?:.*(-S[\s]+{{ item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$'
+ contains: '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch={{{ arch }}}[\s]+)(?:.*(-S[\s]+{{ item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*{{{ fields_data.regex }}}(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$'
patterns: "*.rules"
register: audit_syscalls_found_{{{ arch }}}_rules_d
loop: "{{ syscalls }}"
@@ -401,7 +410,7 @@ Note that if there already exists a rule wit the same key in the /etc/audit/rul
loop: "{{ audit_syscalls_found_{{{ arch }}}_rules_d.results }}"
when: item.matched is defined and item.matched == 0
- name: "Construct rule: add key"
- set_fact: tmpline="{{ tmpline + '-k {{{ key }}}' }}"
+ set_fact: tmpline="{{ tmpline + '{{{ fields_data.list }}} -k {{{ key }}}' }}"
- name: "Insert the line in {{ all_files[0] }}"
lineinfile:
path: "{{ all_files[0] }}"
@@ -417,8 +426,10 @@ The macro requires following parameters:
- arch: an architecture to be used in the Audit rule (b32, b64)
- syscalls: list of syscalls supplied as a list ["syscall1", "syscall2"] etc.
- key: a key to use as rule identifier.
+- fields (optional): list of syscall fields to add (e.g.: auid=unset, exit=-EPERM, a0&0100);
+ Add them in the order you expect them to be in the audit rule.
#}}
-{{% macro ansible_audit_auditctl_add_syscall_rule(arch="", syscalls=[], key="") -%}}
+{{% macro ansible_audit_auditctl_add_syscall_rule(arch="", syscalls=[], key="", fields=[]) -%}}
- name: Declare list of syscals
set_fact:
syscalls: {{{ syscalls }}}
@@ -426,10 +437,17 @@ The macro requires following parameters:
- name: Declare number of syscalls
set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"
+{{# This dictionary is a Jinja2 trick to allow loops to change variables defined out of its scope #}}
+{{% set fields_data = { 'regex' : "", 'list': "" } %}}
+{{% for field in fields %}}
+ {{% set not_used = fields_data.update({'regex': fields_data.regex + '(?:-F\s+' + field + ')'}) %}}
+ {{% set not_used = fields_data.update({'list': fields_data.list + ' -F ' + field }) %}}
+{{% endfor %}}
+
- name: Check existence of syscalls for architecture {{{ arch }}} in /etc/audit/audit.rules
find:
paths: "/etc/audit"
- contains: '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch={{{ arch }}}[\s]+)(?:.*(-S[\s]+{{ item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$'
+ contains: '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch={{{ arch }}}[\s]+)(?:.*(-S[\s]+{{ item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*{{{ fields_data.regex }}}(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$'
patterns: "audit.rules"
register: audit_syscalls_found_{{{ arch }}}_audit_rules
loop: "{{ syscalls }}"
@@ -445,8 +463,8 @@ The macro requires following parameters:
set_fact: tmpline="{{tmpline + '-S ' + item.item + ' ' }}"
loop: "{{ audit_syscalls_found_{{{ arch }}}_audit_rules.results }}"
when: item.matched is defined and item.matched == 0
- - name: "Construct rule: add key"
- set_fact: tmpline="{{ tmpline + '-k {{{ key }}}' }}"
+ - name: "Construct rule: add fields and key"
+ set_fact: tmpline="{{ tmpline + '{{{ fields_data.list }}} -k {{{ key }}}' }}"
- name: Insert the line in /etc/audit/audit.rules
lineinfile:
path: "/etc/audit/audit.rules"
From 5de069a558c4456d0610764d8fc9da23f0ba294e Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Wed, 29 Apr 2020 18:43:08 +0200
Subject: [PATCH 2/6] Fix spacing between syscalls and fields
By having the white space at the beginning of the token, it is easy to
concatenate them without worries.
---
shared/macros-ansible.jinja | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja
index 7674c290fa..2aaf0c366b 100644
--- a/shared/macros-ansible.jinja
+++ b/shared/macros-ansible.jinja
@@ -404,12 +404,12 @@ Note that if there already exists a rule wit the same key in the /etc/audit/rul
- name: "Insert the syscall rule in {{ all_files[0] }}"
block:
- name: "Construct rule: add rule list, action and arch"
- set_fact: tmpline="-a always,exit -F arch={{{ arch }}} "
+ set_fact: tmpline="-a always,exit -F arch={{{ arch }}}"
- name: "Construct rule: add syscalls"
- set_fact: tmpline="{{tmpline + '-S ' + item.item + ' ' }}"
+ set_fact: tmpline="{{tmpline + ' -S ' + item.item }}"
loop: "{{ audit_syscalls_found_{{{ arch }}}_rules_d.results }}"
when: item.matched is defined and item.matched == 0
- - name: "Construct rule: add key"
+ - name: "Construct rule: add fields and key"
set_fact: tmpline="{{ tmpline + '{{{ fields_data.list }}} -k {{{ key }}}' }}"
- name: "Insert the line in {{ all_files[0] }}"
lineinfile:
@@ -458,9 +458,9 @@ The macro requires following parameters:
- name: Insert the syscall rule in /etc/audit/audit.rules
block:
- name: "Construct rule: add rule list, action and arch"
- set_fact: tmpline="-a always,exit -F arch={{{ arch }}} "
+ set_fact: tmpline="-a always,exit -F arch={{{ arch }}}"
- name: "Construct rule: add syscalls"
- set_fact: tmpline="{{tmpline + '-S ' + item.item + ' ' }}"
+ set_fact: tmpline="{{tmpline + ' -S ' + item.item }}"
loop: "{{ audit_syscalls_found_{{{ arch }}}_audit_rules.results }}"
when: item.matched is defined and item.matched == 0
- name: "Construct rule: add fields and key"
From 80a3b0cca2b3af62e1a7cff578a45e844bd12fb4 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 30 Apr 2020 09:10:41 +0200
Subject: [PATCH 3/6] Add tests for audit_rules_time_clock_settime
---
.../tests/correct_syscall.pass.sh | 7 +++++++
.../tests/incorrect_arg_field.fail.sh | 7 +++++++
.../tests/incorrect_syscall.fail.sh | 7 +++++++
3 files changed, 21 insertions(+)
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/tests/correct_syscall.pass.sh
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/tests/incorrect_arg_field.fail.sh
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/tests/incorrect_syscall.fail.sh
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/tests/correct_syscall.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/tests/correct_syscall.pass.sh
new file mode 100644
index 0000000000..b71cc454bc
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/tests/correct_syscall.pass.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# profiles = xccdf_org.ssgproject.content_profile_cis
+
+rm -rf /etc/audit/rules.d/*.rules
+echo "-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -k time-change" >> /etc/audit/rules.d/time.rules
+echo "-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -k time-change" >> /etc/audit/rules.d/time.rules
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/tests/incorrect_arg_field.fail.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/tests/incorrect_arg_field.fail.sh
new file mode 100644
index 0000000000..add0722747
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/tests/incorrect_arg_field.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# profiles = xccdf_org.ssgproject.content_profile_cis
+
+rm -rf /etc/audit/rules.d/*.rules
+echo "-a always,exit -F arch=b32 -S clock_settime -F a0=0x1 -k time-change" >> /etc/audit/rules.d/time.rules
+echo "-a always,exit -F arch=b64 -S clock_settime -F a0=0x1 -k time-change" >> /etc/audit/rules.d/time.rules
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/tests/incorrect_syscall.fail.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/tests/incorrect_syscall.fail.sh
new file mode 100644
index 0000000000..9ab5cc3bc4
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/tests/incorrect_syscall.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# profiles = xccdf_org.ssgproject.content_profile_cis
+
+rm -rf /etc/audit/rules.d/*.rules
+echo "-a always,exit -F arch=b32 -S stime -F a0=0x0 -k time-change" >> /etc/audit/rules.d/time.rules
+echo "-a always,exit -F arch=b64 -S stime -F a0=0x0 -k time-change" >> /etc/audit/rules.d/time.rules
From a5b36f8400f821e35fc5a7e77b36a9fee0124702 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 30 Apr 2020 09:34:35 +0200
Subject: [PATCH 4/6] Add Ansible for audit syscall clock_settime
Also demonstrates how to use the fields parameter in ansible audit
syscall macro.
---
.../ansible/shared.yml | 22 +++++++++++++++++++
1 file changed, 22 insertions(+)
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/ansible/shared.yml
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/ansible/shared.yml
new file mode 100644
index 0000000000..e77850fa25
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/ansible/shared.yml
@@ -0,0 +1,22 @@
+# platform = multi_platform_all
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+# What architecture are we on?
+#
+- name: Set architecture for audit tasks
+ set_fact:
+ audit_arch: "b{{ ansible_architecture | regex_replace('.*(\\d\\d$)','\\1') }}"
+
+- name: Perform remediation of Audit rules for clock_settime for x86 platform
+ block:
+ {{{ ansible_audit_augenrules_add_syscall_rule(arch="b32", syscalls=["clock_settime"], key="time-change", fields=["a0=0x0"])|indent(4) }}}
+ {{{ ansible_audit_auditctl_add_syscall_rule(arch="b32", syscalls=["clock_settime"], key="time-change", fields=["a0=0x0"])|indent(4) }}}
+
+- name: Perform remediation of Audit rules for clock_settime for x86_64 platform
+ block:
+ {{{ ansible_audit_augenrules_add_syscall_rule(arch="b64", syscalls=["clock_settime"], key="time-change", fields=["a0=0x0"])|indent(4) }}}
+ {{{ ansible_audit_auditctl_add_syscall_rule(arch="b64", syscalls=["clock_settime"], key="time-change", fields=["a0=0x0"])|indent(4) }}}
+ when: audit_arch == "b64"
From fe179d4d870878d29b603e7ab5a8bc79cb8eb05c Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 30 Apr 2020 11:54:03 +0200
Subject: [PATCH 5/6] Fix regex spacing between fields and the key
There needs to be a space between them.
Change syntax to be consistent with rest of regex.
---
shared/macros-ansible.jinja | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja
index 2aaf0c366b..eeafe5f6d5 100644
--- a/shared/macros-ansible.jinja
+++ b/shared/macros-ansible.jinja
@@ -367,7 +367,7 @@ Note that if there already exists a rule wit the same key in the /etc/audit/rul
{{# This dictionary is a Jinja2 trick to allow loops to change variables defined out of its scope #}}
{{% set fields_data = { 'regex' : "", 'list': "" } %}}
{{% for field in fields %}}
- {{% set not_used = fields_data.update({'regex': fields_data.regex + '(?:-F\s+' + field + ')'}) %}}
+ {{% set not_used = fields_data.update({'regex': fields_data.regex + '(?:-F[\s]+' + field + '[\s]+)'}) %}}
{{% set not_used = fields_data.update({'list': fields_data.list+ ' -F ' + field }) %}}
{{% endfor %}}
@@ -440,7 +440,7 @@ The macro requires following parameters:
{{# This dictionary is a Jinja2 trick to allow loops to change variables defined out of its scope #}}
{{% set fields_data = { 'regex' : "", 'list': "" } %}}
{{% for field in fields %}}
- {{% set not_used = fields_data.update({'regex': fields_data.regex + '(?:-F\s+' + field + ')'}) %}}
+ {{% set not_used = fields_data.update({'regex': fields_data.regex + '(?:-F[\s]+' + field + '[\s]+)'}) %}}
{{% set not_used = fields_data.update({'list': fields_data.list + ' -F ' + field }) %}}
{{% endfor %}}
From 5e13b1a6698d4403cf4108664fd2c33be5ee9109 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 30 Apr 2020 14:41:59 +0200
Subject: [PATCH 6/6] Improve macro documenation and clarify var name
---
shared/macros-ansible.jinja | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja
index eeafe5f6d5..7b64341fb7 100644
--- a/shared/macros-ansible.jinja
+++ b/shared/macros-ansible.jinja
@@ -364,11 +364,14 @@ Note that if there already exists a rule wit the same key in the /etc/audit/rul
- name: Declare number of syscalls
set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"
-{{# This dictionary is a Jinja2 trick to allow loops to change variables defined out of its scope #}}
-{{% set fields_data = { 'regex' : "", 'list': "" } %}}
+{{#
+This dictionary is a Jinja2 trick to allow loops to change variables defined out of its scope.
+See official documentation: https://jinja.palletsprojects.com/en/2.11.x/templates/#assignments
+#}}
+{{% set fields_data = { 'regex' : "", 'plain_text': "" } %}}
{{% for field in fields %}}
{{% set not_used = fields_data.update({'regex': fields_data.regex + '(?:-F[\s]+' + field + '[\s]+)'}) %}}
- {{% set not_used = fields_data.update({'list': fields_data.list+ ' -F ' + field }) %}}
+ {{% set not_used = fields_data.update({'plain_text': fields_data.plain_text + ' -F ' + field }) %}}
{{% endfor %}}
- name: Check existence of syscalls for architecture {{{ arch }}} in /etc/audit/rules.d/
@@ -410,7 +413,7 @@ Note that if there already exists a rule wit the same key in the /etc/audit/rul
loop: "{{ audit_syscalls_found_{{{ arch }}}_rules_d.results }}"
when: item.matched is defined and item.matched == 0
- name: "Construct rule: add fields and key"
- set_fact: tmpline="{{ tmpline + '{{{ fields_data.list }}} -k {{{ key }}}' }}"
+ set_fact: tmpline="{{ tmpline + '{{{ fields_data.plain_text }}} -k {{{ key }}}' }}"
- name: "Insert the line in {{ all_files[0] }}"
lineinfile:
path: "{{ all_files[0] }}"
@@ -437,11 +440,14 @@ The macro requires following parameters:
- name: Declare number of syscalls
set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"
-{{# This dictionary is a Jinja2 trick to allow loops to change variables defined out of its scope #}}
-{{% set fields_data = { 'regex' : "", 'list': "" } %}}
+{{#
+This dictionary is a Jinja2 trick to allow loops to change variables defined out of its scope.
+See official documentation: https://jinja.palletsprojects.com/en/2.11.x/templates/#assignments
+#}}
+{{% set fields_data = { 'regex' : "", 'plain_text': "" } %}}
{{% for field in fields %}}
{{% set not_used = fields_data.update({'regex': fields_data.regex + '(?:-F[\s]+' + field + '[\s]+)'}) %}}
- {{% set not_used = fields_data.update({'list': fields_data.list + ' -F ' + field }) %}}
+ {{% set not_used = fields_data.update({'plain_text': fields_data.plain_text + ' -F ' + field }) %}}
{{% endfor %}}
- name: Check existence of syscalls for architecture {{{ arch }}} in /etc/audit/audit.rules
@@ -464,7 +470,7 @@ The macro requires following parameters:
loop: "{{ audit_syscalls_found_{{{ arch }}}_audit_rules.results }}"
when: item.matched is defined and item.matched == 0
- name: "Construct rule: add fields and key"
- set_fact: tmpline="{{ tmpline + '{{{ fields_data.list }}} -k {{{ key }}}' }}"
+ set_fact: tmpline="{{ tmpline + '{{{ fields_data.plain_text }}} -k {{{ key }}}' }}"
- name: Insert the line in /etc/audit/audit.rules
lineinfile:
path: "/etc/audit/audit.rules"