>From 7958ed1fcb739c1a6e63bd654482009158018475 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 25 Feb 2012 17:51:44 -0500 Subject: [PATCH 24/24] Updated audit_file_deletions to include linking and rename events Created object_audit_rules_file_link_symlink_events in audit_rules_file_deletion_events.xml to perform the check --- .../checks/audit_rules_file_deletion_events.xml | 6 ++++++ rhel6/src/input/system/auditing.xml | 8 +++++--- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/rhel6/src/input/checks/audit_rules_file_deletion_events.xml b/rhel6/src/input/checks/audit_rules_file_deletion_events.xml index 77855fa..cbc191b 100644 --- a/rhel6/src/input/checks/audit_rules_file_deletion_events.xml +++ b/rhel6/src/input/checks/audit_rules_file_deletion_events.xml @@ -14,10 +14,16 @@ + /etc/audit/audit.rules ^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+unlink\s+\-S\s+unlinkat\s+\-S\s+rename\s+\-S\s+renameat\s+\-F\s+auid>=500\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$ 1 + + /etc/audit/audit.rules + ^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+link\s+\-S\s+linkat\s+\-S\s+symlink\s+\-S\s+symlinkat\s+\-F\s+auid>=500\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$ + 1 + diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index d01c5fb..5c59c3d 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -397,15 +397,17 @@ loss. -Ensure <tt>auditd</tt> Collects Files Deletion Events by User +Ensure <tt>auditd</tt> Collects File Deletion, Moving, and Linking Events by User At a minimum the audit system should collect file -deletion events for all users and root. Add the following to +deletion, moving, and linking events for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system:
 -a always,exit -F arch=ARCH -S unlink -S unlinkat -S rename -S renameat \
-    -F auid>=500 -F auid!=4294967295 -k delete
+    -F auid>=500 -F auid!=4294967295 -k audit_file_deletions
+-a always,exit -F arch=ARCH -S link -S linkat -S symlink -S symlinkat \
+    -F auid>=500 -F auid!=4294967295 -k audit_file_deletions
 
Auditing file deletions will create an audit trail for files that are removed -- 1.7.1