On Thursday, June 27, 2013 06:34:31 PM Trevor Vaughan wrote:
All,
Currently the remediation text for RHEL-06-000198 reads as:
At a minimum the audit system should collect the execution of privileged
commands for all users and root. To find the relevant setuid programs:
# find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null
Then, for each setuid program on the system, add a line of the following
form to "/etc/audit/audit.rules", where [SETUID_PROG_PATH] is the full path
to each setuid program in the list:
-a always,exit -F path=[SETUID_PROG_PATH] -F perm=x -F auid>=500 -F
auid!=4294967295 -k privileged
I would like to suggest that this be changed to
Add the following to audit.rules:
-a always,exit -F arch=b64 -F euid=0 -F uid!=0 -S execve -k suid-root-exec
-a always,exit -F arch=b64 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec
-a always,exit -F arch=b32 -F euid=0 -F uid!=0 -S execve -k suid-root-exec
-a always,exit -F arch=b32 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec
From my testing, this appears to catch the execution of all suid/sgit
binaries without digging all over the system to figure out what they are.
The drawback to this method is that you have 4 rules that get evaluated for
each and every syscall made to the kernel. Syscall rules have performance
impacts. I would also switch out uid!=0 to auid>=500 auid!=4294967295. The
reason being that the threat is what a user does rather than normal system
operation.
Regarding setgid, there are no apps that are setgid root.
As an added bonus, you get to find out about binaries that pop onto
your
system for a brief period.
Does that actually happen? World writable dirs should have -noexec mount
option and that leaves a user's home dir as the only place that could happen
unless an admin installs apps. /home should be mounted -nosuid so...can it
happen?
-Steve