>From 54c0f85c53030dfa69106b4f273dc05ca7391199 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 25 Feb 2012 16:19:19 -0500 Subject: [PATCH 19/24] Added a check for /etc/modprobe.d/ to audit_kernel_module_loading The modprobe.d directory should be watched as well, not just the binary --- .../checks/audit_rules_kernel_module_loading.xml | 11 ++++++++++- rhel6/src/input/system/auditing.xml | 1 + 2 files changed, 11 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/checks/audit_rules_kernel_module_loading.xml b/rhel6/src/input/checks/audit_rules_kernel_module_loading.xml index de4990b..158bcb1 100644 --- a/rhel6/src/input/checks/audit_rules_kernel_module_loading.xml +++ b/rhel6/src/input/checks/audit_rules_kernel_module_loading.xml @@ -11,7 +11,8 @@ - + + @@ -39,6 +40,14 @@ ^\-w\s+/sbin/modprobe\s+\-p\s+x\s+\-k\s+[-\w]+\s*$ 1 + + + + + /etc/audit/audit.rules + ^\-w\s+/etc/modprobe.d/\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$ + 1 + diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index bd6291c..d4955a0 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -431,6 +431,7 @@ to capture kernel module loading and unloading events: -w /sbin/insmod -p x -k audit_kernel_module_loading -w /sbin/rmmod -p x -k audit_kernel_module_loading -w /sbin/modprobe -p x -k audit_kernel_module_loading +-w /etc/modprobe.d/ -p wa -k audit_kernel_module_loading -a always,exit -S init_module -S delete_module -k audit_kernel_module_loading The addition/removal of kernel modules can be used to alter the behavior of -- 1.7.1