>From 0e1ff346814513209701669a429def1014816060 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 25 Feb 2012 15:02:23 -0500 Subject: [PATCH 14/24] Altered audit_dac_actions for fchown32, chown32, and lchown32 on 32-bit systems --- rhel6/src/input/system/auditing.xml | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index fa63f1d..ad28607 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -267,6 +267,9 @@ anything other than administrator action. All changes to MAC policy should be au -a always,exit -F arch=ARCH -S setxattr -S lsetxattr \ -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr \ -F auid>=500 -F auid!=4294967295 -k audit_dac_actions +
+Additionally, if you are on a 32-bit system add the following audit rule: +
-a always,exit -F arch=b32 -S truncate64 -S ftruncate64
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications -- 1.7.1