[PATCH 24/24] Updated audit_file_deletions to include linking and rename events Created object_audit_rules_file_link_symlink_events in audit_rules_file_deletion_events.xml to perform the check

Shawn Wells shawn at redhat.com
Sat Feb 25 22:51:44 UTC 2012


---
 .../checks/audit_rules_file_deletion_events.xml    |    6 ++++++
 rhel6/src/input/system/auditing.xml                |    8 +++++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/rhel6/src/input/checks/audit_rules_file_deletion_events.xml b/rhel6/src/input/checks/audit_rules_file_deletion_events.xml
index 77855fa..cbc191b 100644
--- a/rhel6/src/input/checks/audit_rules_file_deletion_events.xml
+++ b/rhel6/src/input/checks/audit_rules_file_deletion_events.xml
@@ -14,10 +14,16 @@
   </definition>
   <ind:textfilecontent54_test check="all" comment="audit file delete" id="test_audit_rules_file_deletion_events" version="1">
     <ind:object object_ref="object_audit_rules_file_deletion_events" />
+    <ind:object object_ref="object_audit_rules_file_link_symlink_events" />
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="object_audit_rules_file_deletion_events" version="1">
     <ind:filepath>/etc/audit/audit.rules</ind:filepath>
     <ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+unlink\s+\-S\s+unlinkat\s+\-S\s+rename\s+\-S\s+renameat\s+\-F\s+auid>=500\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
+  <ind:textfilecontent54_object id="object_audit_rules_file_link_symlink_events" version="1">
+    <ind:filepath>/etc/audit/audit.rules</ind:filepath>
+    <ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+link\s+\-S\s+linkat\s+\-S\s+symlink\s+\-S\s+symlinkat\s+\-F\s+auid>=500\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
 </def-group>
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index d01c5fb..5c59c3d 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -397,15 +397,17 @@ loss.</rationale>
 </Rule>
 
 <Rule id="audit_file_deletions">
-<title>Ensure <tt>auditd</tt> Collects Files Deletion Events by User</title>
+<title>Ensure <tt>auditd</tt> Collects File Deletion, Moving, and Linking Events by User</title>
 <description>At a minimum the audit system should collect file
-deletion events for all users and root. Add the following to
+deletion, moving, and linking events for all users and root. Add the following to
 <tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as
 appropriate for your system:
 <br />
 <pre>
 -a always,exit -F arch=ARCH -S unlink -S unlinkat -S rename -S renameat \
-    -F auid&gt;=500 -F auid!=4294967295 -k delete
+    -F auid&gt;=500 -F auid!=4294967295 -k audit_file_deletions
+-a always,exit -F arch=ARCH -S link -S linkat -S symlink -S symlinkat \
+    -F auid&gt;=500 -F auid!=4294967295 -k audit_file_deletions
 </pre>
 </description>
 <rationale>Auditing file deletions will create an audit trail for files that are removed
-- 
1.7.1


--+HP7ph2BbKc20aGI--


More information about the scap-security-guide mailing list