All,
I've been running in compliance with this rule for quite some time now and
I'm noticing that the amount of noise that it produces is simply outrageous.
The suggestion is:
At a minimum the audit system should collect file permission changes for
all users and root. Add the following to "/etc/audit/audit.rules":
-a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 \
-k perm_mod
If the system is 64 bit then also add the following:
-a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 \
-k perm_mod
And here is the output of a normal workstation over about a week of
auditing and normal usage:
Syscall Summary Report
==========================
total syscall
==========================
24907 chmod
15870 chown
11169 rename
7409 open
6462 fchmod
5290 fchown
3687 umount2
1443 setsid
1166 fsetxattr
869 removexattr
456 adjtimex
360 fchmodat
337 lchown
211 setuid
69 mkdir
63 setsockopt
33 unlink
22 setxattr
20 clone
19 execve
7 fchownat
7 mount
7 creat
4 close
4 ioctl
3 symlink
2 mknod
1 rmdir
1 lsetxattr
1 clock_settime
1 capset
So, I get why this can be useful. But I'm not so sure that it's useful to
know that Pidgin dropped a new temp file every few minutes or that, each
time I open a file (and write a temp file), that I did this as a normal
user.
I just can't see the practicality of going through those top three calls on
a regular basis.
I'm not necessarily suggesting that this type of thing be dropped but I'd
like to understand how auditors won't fall into just ignoring them
completely.
Thoughts?
Thanks,
Trevor
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan(a)onyxpoint.com
-- This account not approved for unencrypted proprietary information --