Re: Suggesting adding hidepid=2 on /proc to the SSG
by Immo Niemela
Hi All,
Personally I would like to have hidepid=2 _by_default_. If problems arise then people could choose a different profile or tailor the profile to suit them better. There should be sufficient documentation on that.
This way people might start realising there need to be changes to software they are maintaining or developing.
Regards,
Immo Niemela
--
Sent from yet another mobile device. Please excuse my brevity.
5 years, 7 months
Updating audit rules for container platforms
by Shawn Wells
Received an interesting question from a colleague today.
The various STIG requirements have full paths for auditing, e.g. for
/usr/bin/chage:
https://rhel7stig.readthedocs.io/en/latest/medium.html#v-72155-all-uses-o...
Which call for an audit rule similar to:
> -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F
> auid!=4294967295 -k privileged-passwd
However, on a container platform (e.g. OpenShift), the root user on
nodes can execute chage in its own /usr/bin/ as well as within all the
containers /var/lib/docker/<UUID>/bin/chage.
What's the best way to capture this in OVAL rules? Was thinking updating
the regex on path to include the full-path
(/usr/bin/chage|/var/lib/docker/*/bin/chage).... but not sure if that's
a standard path that would work for non-OpenShift platforms.
+cc Jeff Pullen who asked the question. Jeff... note this is a *public*
mailing list ;)
5 years, 7 months