All,
Currently the remediation text for RHEL-06-000198 reads as:
At a minimum the audit system should collect the execution of privileged
commands for all users and root. To find the relevant setuid programs:
# find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null
Then, for each setuid program on the system, add a line of the following
form to "/etc/audit/audit.rules", where [SETUID_PROG_PATH] is the full path
to each setuid program in the list:
-a always,exit -F path=[SETUID_PROG_PATH] -F perm=x -F auid>=500 -F
auid!=4294967295 -k privileged
I would like to suggest that this be changed to
Add the following to audit.rules:
-a always,exit -F arch=b64 -F euid=0 -F uid!=0 -S execve -k suid-root-exec
-a always,exit -F arch=b64 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec
-a always,exit -F arch=b32 -F euid=0 -F uid!=0 -S execve -k suid-root-exec
-a always,exit -F arch=b32 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec
>From my testing, this appears to catch the execution of all suid/sgit
binaries without digging all over the system to figure out what they are.
As an added bonus, you get to find out about binaries that pop onto your
system for a brief period.
Thanks,
Trevor
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan(a)onyxpoint.com
-- This account not approved for unencrypted proprietary information --