>From b361f6fe3dd4268adcf50df936309585b6fc713a Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Wed, 4 Jul 2012 02:17:21 -0400 Subject: [PATCH 09/11] Updated audit_dac_actions - Changed title of audit_dac_actions to match style of MAC rule title - MAC and DAC auditing placed immediately after each other increases readability of the guide - Mapped to CCI-126 --- rhel6/src/input/system/auditing.xml | 48 +++++++++++++++++----------------- 1 files changed, 24 insertions(+), 24 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 2ab0adf..0633724 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -535,6 +535,30 @@ MAC policy should be audited. + +Record Events that Modify the System's Discretionary +Access Controls +At a minimum the audit system should collect file +permission changes for all users and root. Add the following to +/etc/audit/audit.rules, setting ARCH to either b32 or b64 as +appropriate for your system: +
-a always,exit -F arch=ARCH -S chmod -S fchmod -S fchmodat \
+    -F auid>=500 -F auid!=4294967295 -k perm_mod
+    -a always,exit -F arch=ARCH -S chown -S fchown -S fchownat \
+    -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod
+    -a always,exit -F arch=ARCH -S setxattr -S lsetxattr \
+    -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr \
+    -F auid>=500 -F auid!=4294967295 -k perm_mod
+
+The changing of file permissions could indicate that a user is attempting to +gain access to information that would otherwise be disallowed. Auditing DAC modifications +can facilitate the identification of patterns of abuse amoung both authorized and +unauthorized users. + + + +
+ Record Attempts to Alter Logon and Logout Events @@ -567,30 +591,6 @@ as an attacker attempting to remove evidence of an intrusion. - -Ensure <tt>auditd</tt> Collects Discretionary Access Control -Permission Modification Events -At a minimum the audit system should collect file -permission changes for all users and root. Add the following to -/etc/audit/audit.rules, setting ARCH to either b32 or b64 as -appropriate for your system: -
-a always,exit -F arch=ARCH -S chmod -S fchmod -S fchmodat \
-    -F auid>=500 -F auid!=4294967295 -k perm_mod
--a always,exit -F arch=ARCH -S chown -S fchown -S fchownat \
-    -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod
--a always,exit -F arch=ARCH -S setxattr -S lsetxattr \
-    -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr \
-    -F auid>=500 -F auid!=4294967295 -k perm_mod
-
-The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse amoung both authorized and -unauthorized users. - - - -
- Ensure <tt>auditd</tt> Collects Unauthorized Access Attempts to Files (unsuccessful) At a minimum the audit system should collect -- 1.7.1