All,

Currently the remediation text for RHEL-06-000198 reads as:

At a minimum the audit system should collect the execution of privileged commands for all users and root. To find the relevant setuid programs:

  # find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null

  Then, for each setuid program on the system, add a line of the following form to "/etc/audit/audit.rules", where [SETUID_PROG_PATH] is the full path to each setuid program in the list:

  -a always,exit -F path=[SETUID_PROG_PATH] -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

I would like to suggest that this be changed to

Add the following to audit.rules:
  -a always,exit -F arch=b64 -F euid=0 -F uid!=0 -S execve -k suid-root-exec
  -a always,exit -F arch=b64 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec
  -a always,exit -F arch=b32 -F euid=0 -F uid!=0 -S execve -k suid-root-exec
  -a always,exit -F arch=b32 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec

From my testing, this appears to catch the execution of all suid/sgit binaries without digging all over the system to figure out what they are. As an added bonus, you get to find out about binaries that pop onto your system for a brief period.

Thanks,

Trevor
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan@onyxpoint.com

-- This account not approved for unencrypted proprietary information --