[PATCH 24/24] Updated audit_file_deletions to include linking and rename events Created object_audit_rules_file_link_symlink_events in audit_rules_file_deletion_events.xml to perform the check
Shawn Wells
shawn at redhat.com
Sat Feb 25 22:51:44 UTC 2012
---
.../checks/audit_rules_file_deletion_events.xml | 6 ++++++
rhel6/src/input/system/auditing.xml | 8 +++++---
2 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/rhel6/src/input/checks/audit_rules_file_deletion_events.xml b/rhel6/src/input/checks/audit_rules_file_deletion_events.xml
index 77855fa..cbc191b 100644
--- a/rhel6/src/input/checks/audit_rules_file_deletion_events.xml
+++ b/rhel6/src/input/checks/audit_rules_file_deletion_events.xml
@@ -14,10 +14,16 @@
</definition>
<ind:textfilecontent54_test check="all" comment="audit file delete" id="test_audit_rules_file_deletion_events" version="1">
<ind:object object_ref="object_audit_rules_file_deletion_events" />
+ <ind:object object_ref="object_audit_rules_file_link_symlink_events" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_audit_rules_file_deletion_events" version="1">
<ind:filepath>/etc/audit/audit.rules</ind:filepath>
<ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+unlink\s+\-S\s+unlinkat\s+\-S\s+rename\s+\-S\s+renameat\s+\-F\s+auid>=500\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
+ <ind:textfilecontent54_object id="object_audit_rules_file_link_symlink_events" version="1">
+ <ind:filepath>/etc/audit/audit.rules</ind:filepath>
+ <ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+link\s+\-S\s+linkat\s+\-S\s+symlink\s+\-S\s+symlinkat\s+\-F\s+auid>=500\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
</def-group>
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index d01c5fb..5c59c3d 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -397,15 +397,17 @@ loss.</rationale>
</Rule>
<Rule id="audit_file_deletions">
-<title>Ensure <tt>auditd</tt> Collects Files Deletion Events by User</title>
+<title>Ensure <tt>auditd</tt> Collects File Deletion, Moving, and Linking Events by User</title>
<description>At a minimum the audit system should collect file
-deletion events for all users and root. Add the following to
+deletion, moving, and linking events for all users and root. Add the following to
<tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as
appropriate for your system:
<br />
<pre>
-a always,exit -F arch=ARCH -S unlink -S unlinkat -S rename -S renameat \
- -F auid>=500 -F auid!=4294967295 -k delete
+ -F auid>=500 -F auid!=4294967295 -k audit_file_deletions
+-a always,exit -F arch=ARCH -S link -S linkat -S symlink -S symlinkat \
+ -F auid>=500 -F auid!=4294967295 -k audit_file_deletions
</pre>
</description>
<rationale>Auditing file deletions will create an audit trail for files that are removed
--
1.7.1
--+HP7ph2BbKc20aGI--
More information about the scap-security-guide
mailing list