>From 2b0087ba8f690b3da2b71f7d37ec69dd61b26eaf Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Tue, 21 Feb 2012 22:15:02 -0500 Subject: [PATCH 07/11] - Updated audit_dac_actions, changed -k to audit_dac_actions - Formating fixes --- rhel6/src/input/system/auditing.xml | 18 +++++++----------- 1 files changed, 7 insertions(+), 11 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 93b95dc..2e943d8 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -226,21 +226,17 @@ anything other than administrator action. All changes to MAC policy should be au -Ensure <tt>auditd</tt> Collects Discretionary Access Control -Permission Modification Events -At a minimum the audit system should collect file -permission changes for all users and root. Add the following to -/etc/audit/audit.rules, setting ARCH to either b32 or b64 as -appropriate for your system: +Ensure <tt>auditd</tt> Collects Discretionary Access Control Policy Modification Events +At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system:
-
+
# audit_dac_actions
 -a always,exit -F arch=ARCH -S chmod -S fchmod -S fchmodat \
-    -F auid>=500 -F auid!=4294967295 -k perm_mod
+    -F auid>=500 -F auid!=4294967295 -k audit_dac_actions
 -a always,exit -F arch=ARCH -S chown -S fchown -S fchownat \ 
-    -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod
+    -S lchown -F auid>=500 -F auid!=4294967295 -k audit_dac_actions
 -a always,exit -F arch=ARCH -S setxattr -S lsetxattr \
     -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr \
-    -F auid>=500 -F auid!=4294967295 -k perm_mod
+ -F auid>=500 -F auid!=4294967295 -k audit_dac_actions
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications @@ -248,7 +244,7 @@ can facilitate the identification of patterns of abuse amoung both authorized an unauthorized users. - +
-- 1.7.1