Hello,
On Friday, October 24, 2014 11:48:57 AM Glass, Jermaine CTR/NSOC wrote:
Although a new STIG was released today, I didn't see where that new STIG
took the below information in consideration.
First, Red Hat Security Engineering has not reviewed the RHEL 6 STIG.
I would like to share with you some information that was recently
discovered. RHEL 6.6 was released earlier this month (Oct. 14th).
(1) The audit program and its supported programs (i.e., auditd, auditctl)
has changed in RHEL 6.6.
RHEL 6.5
---------
rpm -qa | grep "audit-[[:digit:]]"
audit-2.2-4.el6_5.x86_64
RHEL 6.6
--------
rpm -qa | grep "audit-[[:digit:]]"
audit-2.3.7-5.el6.x86_64
(2) The output of the command has changed.
RHEL 6.5
---------
auditctl -l | head -n 2
LIST_RULES: exit,always watch=/bin/login perm=x
LIST_RULES: exit,always arch=1073741827 (0x40000003) key=audit_time_rules
syscall=adjtimex
RHEL 6.6
--------
auditctl -l | head -n 2
-a never,exit -S all -F path=/var/lib/net-snmp/mib_indexes -F key=exclude
-a never,exit -S all -F dir=/omd/sites/monnsoc/var/pnp4nagios/perfdata -F
key=exclude
Yes, it has! This is a much needed change to start getting the rules in a
format that looks like what went into the kernel. The plan is to eventually be
able to do
auditctl -l > audit.in-kernel
diff -u /etc/audit/audit.rules audit.in-kernel
so that differences between what's expected and what's enforced can be found.
Another side effect of this change is that now you can pass -i to auditctl to
get an interpretation of the rule. For example,
# auditctl -l | grep container-create
-a always,exit -F arch=i386 -S clone -F a0&0x7C020000 -F key=container-create
becomes
# auditctl -l -i | grep container-create
-a always,exit -F arch=i386 -S clone -F a0&CLONE_NEWNS|CLONE_NEWUTS|
CLONE_NEWIPC|CLONE_NEWUSER|CLONE_NEWPID|CLONE_NEWNET -F key=container-create
This lets you verify a complicated rule to make sure you have exactly what you
expected.
(3) In fact, the LIST_RULES tag and format that is present in earlier
versions of RHEL 6 has been stripped out of the output. Using the strings
command on the auditctl executable showed me the tags that the auditctl
program uses in its output.
RHEL 6.5
---------
strings /sbin/auditctl | grep LIST_RULES
LIST_RULES
RHEL 6.6
--------
strings /sbin/auditctl | grep LIST_RULES
<== No output
This is to be expected. LIST_RULES is a netlink command to the audit system.
It really should not be visible to the outside world. The payload should be,
but not the actual command.
(4) How does this change effect the scanning of the systems for STIG issues?
If it were written for a non-forensics system configuration scan, it should
have no effect.
Take the check for STIG-ID RHEL-06-000165 as an example:
RHEL 6.5
---------
auditctl -l | grep syscall | grep adjtimex
LIST_RULES: exit,always arch=1073741827 (0x40000003) key=audit_time_rules
syscall=adjtimex
LIST_RULES: exit,always arch=3221225534 (0xc000003e) key=audit_time_rules
syscall=adjtimex
RHEL 6.6
--------
auditctl -l | grep syscall | grep adjtimex
<== No output
auditctl -l | grep adjtimex | grep audit_time_rule
-a always,exit -F arch=i386 -S stime,settimeofday,adjtimex -F
key=audit_time_rules
-a always,exit -F arch=x86_64 -S adjtimex,settimeofday,clock_settime -F
key=audit_time_rules
As you can see the "auditctl -l" command in RHEL 6.5 worked as expected for
the STIG. This same check didn't work for systems running RHEL 6.6. The
information above shows why. The output of "auditctl -l" in RHEL 6.6 now
just shows the contents of the audit.rules file.
(5) The below STIG checks are affected by this change. All tools that
directly use checks indentified in the Red Hat 6 STIG--this includes the
SCAP. The following checks are affected (there may be others, I just
looked for checks that had 'grep syscall' in them):
rhel-06-000165
rhel-06-000167
rhel-06-000169
rhel-06-000171
rhel-06-000184
rhel-06-000185
rhel-06-000186
rhel-06-000187
rhel-06-000188
rhel-06-000189
rhel-06-000190
rhel-06-000191
rhel-06-000192
rhel-06-000193
rhel-06-000194
rhel-06-000195
rhel-06-000196
rhel-06-000197
rhel-06-000198
rhel-06-000199
rhel-06-000200
rhel-06-000202