Personally I would like to have hidepid=2 _by_default_. If problems arise then people could choose a different profile or tailor the profile to suit them better. There should be sufficient documentation on that.
This way people might start realising there need to be changes to software they are maintaining or developing.
Sent from yet another mobile device. Please excuse my brevity.
Received an interesting question from a colleague today.
The various STIG requirements have full paths for auditing, e.g. for
Which call for an audit rule similar to:
> -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F
> auid!=4294967295 -k privileged-passwd
However, on a container platform (e.g. OpenShift), the root user on
nodes can execute chage in its own /usr/bin/ as well as within all the
What's the best way to capture this in OVAL rules? Was thinking updating
the regex on path to include the full-path
(/usr/bin/chage|/var/lib/docker/*/bin/chage).... but not sure if that's
a standard path that would work for non-OpenShift platforms.
+cc Jeff Pullen who asked the question. Jeff... note this is a *public*
mailing list ;)