-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 06/27/2013 04:34 PM, Trevor Vaughan wrote:
All,
Currently the remediation text for RHEL-06-000198 reads as:
At a minimum the audit system should collect the execution of
privileged commands for all users and root. To find the relevant
setuid programs:
# find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null
Then, for each setuid program on the system, add a line of the
following form to "/etc/audit/audit.rules", where
[SETUID_PROG_PATH] is the full path to each setuid program in the
list:
-a always,exit -F path=[SETUID_PROG_PATH] -F perm=x -F auid>=500
-F auid!=4294967295 -k privileged
I would like to suggest that this be changed to
Add the following to audit.rules: -a always,exit -F arch=b64 -F
euid=0 -F uid!=0 -S execve -k suid-root-exec -a always,exit -F
arch=b64 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec -a
always,exit -F arch=b32 -F euid=0 -F uid!=0 -S execve -k
suid-root-exec -a always,exit -F arch=b32 -F egid=0 -F gid!=0 -S
execve -k sgid-root-exec
Wouldn't this miss a lot of interesting setgid/setuid to non root user
programs? Whereas the above mentioned fine +4000/+2000 will catch ALL
the currently existing setuid/setgid binaries. Probably best to use both.
From my testing, this appears to catch the execution of all
suid/sgit binaries without digging all over the system to figure
out what they are. As an added bonus, you get to find out about
binaries that pop onto your system for a brief period.
Thanks,
Trevor -- Trevor Vaughan Vice President, Onyx Point, Inc (410)
541-6699 tvaughan(a)onyxpoint.com <mailto:tvaughan@onyxpoint.com>
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRzTKNAAoJEBYNRVNeJnmTAJAP/ixksl5ZPbFAF0t/wusT/5iy
JuE27qDqbo0tav3MFe97h5IfdphkDN67M/La4QhWhsakE+KwbRCB6Ckwztf2GEQo
J97sYLkN4jpmFuNA77am0u0N/6kjfhiKVrBnyLEFosvFUvouOAPMWU8lLJ14hfDw
MgjefhwlgfKvyskfei/5LpspPj87GeVcir4jULdxhWnSlPWua1WViq9bwxU5PDKE
O/1OkLbCeQXfuqZAv6Ol2bXBuBNYuEY9LZOUB0xrpRYBNBAXzPp7dftOlFvUsLL9
uBwJyNjxPY2XhsYCWTdu5OCivoKz5mi3Igkp+VdQFmSkJOeGybBeuBXVaTeLVjco
wOMsezdRSgs1z4E7DhiDJxLlDxXbsbcxcbiVZGHLL5t4Ei7ho0+ex4QqZEgeM2EJ
L8f7YbbDEAE6OUsQgWgNnPvE6iAayrQkoaUZby0NGV5wmJ7dBr6QgGQFUqvXtKv7
HnQRH4l4QWLgA0zXjNTM/LvrmgsnHdBRobF9+uNlKlQpDwhC0OztznN1iuPSv2RU
D8/jOQgyrnXf5lwcXGeL9aY35l2UhpcR3Hjk8uvJltekzmKXdfpUtnNpJ85xl+vb
elEJiMiU8k1nLYttJwa81gh+wjb6CE6cSier8oxt3A8NPRcZDdIlTlBa8NqH4Rn+
ZDrwS6WGuofMdmiGUFky
=Xs9G
-----END PGP SIGNATURE-----