[PATCH 1/3] significant overhaul and QA of auditing section

Jeffrey Blank blank at eclipse.ncsc.mil
Wed Jun 6 01:54:42 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 rhel6/src/input/system/auditing.xml |  362 +++++++++++++++++++++++++----------
 1 files changed, 264 insertions(+), 98 deletions(-)

diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 8b9ecd4..f1cf4a8 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -8,9 +8,6 @@ events performed by programs such as sudo.
 <br /><br />
 Under its default configuration, <tt>auditd</tt> has modest disk space
 requirements, and should not noticeably impact system performance.
-The audit service, in its default configuration, is strongly
-recommended for all sites, regardless of whether they are running
-SELinux.
 <br /><br />
 Government networks often have substantial auditing
 requirements and <tt>auditd</tt> can be configured to meet these
@@ -18,13 +15,18 @@ requirements.
 <br /><br />
 Example requirements include:
 <br /><br />
-<ul>
-<li>Ensure Auditing is Configured to Collect Certain System Events
+
+<ul><li>
+Ensure Auditing is Configured to Collect Certain System Events
 <ul>
 <li>Information on the Use of Print Command (unsuccessful and successful)</li>
 <li>Startup and Shutdown Events (unsuccessful and successful)</li>
-</ul></li>
-<li>Ensure the auditing software can record the following for each
+<li>System Administrator Actions</li>
+</ul>
+</li></ul>
+
+<ul><li>
+Ensure the auditing software can record the following for each
 audit event:
 <ul>
 <li>Date and time of the event</li>
@@ -35,16 +37,7 @@ audit event:
 <li>For events that introduce an object into a user’s address space, and
 for object deletion events, the name of the object, and in MLS systems,
 the objects security level.</li>
-</ul>
-</li>
-<li>Ensure files are backed up no less than weekly onto a different
-system than the system being audited or backup media.</li>
-<li>Ensure old logs are closed out and new audit logs are started
-daily</li>
-<li>Ensure the configuration is immutable. With the <tt>-e 2</tt> setting a
-reboot will be required to change any audit rules.</li>
-<li>Ensure that the audit data files have permissions of 640, or
-more restrictive.</li>
+</ul></li>
 </ul>
 
 <br /><br />
@@ -54,22 +47,26 @@ and certain types of security events, such as modifications to user
 accounts (<tt>useradd</tt>, <tt>passwd</tt>, etc), login events, and
 calls to <tt>sudo</tt>.
 <br /><br />
-Data is stored in <tt>/var/log/audit/audit.log</tt>. By default,
-<tt>auditd</tt> rotates 4 logs by size (5MB), retaining a maximum of 20MB of
+The audit system stores data in <tt>/var/log/audit/audit.log</tt>. By default,
+<tt>auditd</tt> rotates 5 logs by size (6MB), retaining a maximum of 30MB of
 data in total, and refuses to write entries when the disk is too
 full. This minimizes the risk of audit data filling its partition
-and impacting other services. However, it is possible to lose audit
-data if the system is busy.
+and impacting other services.  This also minimizes the risk of the audit
+daemon temporarily disabling the system if it cannot write audit log (which
+it can be configured to do). 
 </description>
 <ref disa="120,166,1338,1339" />
 
 <Rule id="enable_auditd_service">
 <title>Enable auditd Service</title>
-<description>Ensure that the <tt>auditd</tt> service is enabled (this is the
-default):
+<description>The <tt>auditd</tt> service is an essential userspace component of
+the Linux Auditing System, as it is responsible for writing audit records to
+disk.  The <tt>auditd</tt> service can be enabled with the following command:
 <pre># chkconfig auditd on</pre>
 </description>
-<rationale>
+<rationale>Ensuring that the <tt>auditd</tt> service is active ensures that
+audit records generated by the kernel can be written to disk, or that appropriate
+actions will be taken if other obstacles exist.
 </rationale>
 <ident cce="4292-9" />
 <oval id="service_auditd_enabled" />
@@ -98,79 +95,231 @@ process during boot.
 <Group id="configure_auditd_data_retention">
 <title> Configure <tt>auditd</tt> Data Retention</title>
 <description>
-By default, <tt>auditd</tt> retains 4 log files of size 5Mb apiece. For a busy system or a system which is thoroughly
-auditing system activity, this is likely to be insuffcient. 
-The log file size needed will depend heavily on what types of events are being audited. First configure auditing
-to log all the events of interest. Then monitor the log size manually for awhile to determine what file size will
-allow you to keep the required data for the correct time period.
-
-Using a dedicated partition for <tt>/var/log/audit</tt> prevents the <tt>auditd</tt> logs from disrupting system functionality if they fill, and, more importantly, prevents other activity in <tt>/var</tt> from filling the partition and stopping the audit trail. (The audit logs are size-limited and therefore unlikely to grow without bound unless configured to do so.)
-Some machines may have requirements that no actions occur which cannot be audited. If this is the case, then
-<tt>auditd</tt> can be configured to halt the machine if it runs out of space.
-<b>Note:</b> Since older logs are rotated, configuring <tt>auditd</tt> this way does not prevent older logs from being rotated away before they can be viewed.
-
-<i>If your system is configured to halt when logging cannot be performed, make sure this can never
-happen under normal circumstances! Ensure that <tt>/var/log/audit</tt> is on its own partition, and
-that this partition is larger than the maximum amount of data <tt>auditd</tt> will retain normally.</i></description>
-
-<Rule id="configure_auditd_max_log_size">
-<title>Configure auditd Max Log Size</title>
-<description>Determine <i>STOREMB</i>, the amount of audit data (in megabytes) which should be retained in each log
-file. Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line:
+By default, <tt>auditd</tt> retains 5 log files of size 6MB apiece. For a busy
+system or a system which is thoroughly auditing system activity, this may be
+ insuffcient.  The log file size needed will depend heavily on what types
+of events are being audited. First configure auditing to log all the events of
+interest. Then monitor the log size manually for awhile to determine what file
+size will allow you to keep the required data for the correct time period.
+
+Using a dedicated partition for <tt>/var/log/audit</tt> prevents the
+<tt>auditd</tt> logs from disrupting system functionality if they fill, and,
+more importantly, prevents other activity in <tt>/var</tt> from filling the
+partition and stopping the audit trail. (The audit logs are size-limited and
+therefore unlikely to grow without bound unless configured to do so.) Some
+machines may have requirements that no actions occur which cannot be audited.
+If this is the case, then <tt>auditd</tt> can be configured to halt the machine
+if it runs out of space.  <b>Note:</b> Since older logs are rotated,
+configuring <tt>auditd</tt> this way does not prevent older logs from being
+rotated away before they can be viewed.
+
+<i>If your system is configured to halt when logging cannot be performed, make
+sure this can never happen under normal circumstances! Ensure that
+<tt>/var/log/audit</tt> is on its own partition, and that this partition is
+larger than the maximum amount of data <tt>auditd</tt> will retain
+normally.</i>
+</description>
+
+<Value id="var_auditd_num_logs" type="number" >
+<title>Number of log files for auditd to retain</title>
+<description>The setting for num_logs in /etc/audit/auditd.conf</description>
+<value selector="">5</value>
+<value selector="5">5</value>
+<value selector="4">4</value>
+<value selector="3">3</value>
+<value selector="2">2</value>
+<value selector="1">1</value>
+<value selector="0">0</value>
+</Value>
+
+<Value id="var_auditd_max_log_file" type="number" >
+<title>Maximum audit log file size for auditd</title>
+<description>The setting for max_log_size in /etc/audit/auditd.conf</description>
+<value selector="">6</value>
+<value selector="20">20</value>
+<value selector="10">10</value>
+<value selector="6">6</value>
+<value selector="5">5</value>
+<value selector="1">1</value>
+</Value>
+
+<Value id="var_auditd_max_log_file_action" type="string" >
+<title>Action for auditd to take when log files reach their maximum size</title>
+<description>The setting for max_log_file_action in /etc/audit/auditd.conf</description>
+<value selector="">rotate</value>
+<value selector="ignore">ignore</value>
+<value selector="syslog">syslog</value>
+<value selector="suspend">suspend</value>
+<value selector="rotate">rotate</value>
+<value selector="keep_logs">keep_logs</value>
+</Value>
+
+<Value id="var_auditd_space_left_action" type="string" >
+<title>Action for auditd to take when disk space just starts to run low</title>
+<description>The setting for space_left_action in /etc/audit/auditd.conf</description>
+<value selector="">email</value>
+<value selector="ignore">ignore</value>
+<value selector="syslog">syslog</value>
+<value selector="email">email</value>
+<value selector="exec">exec</value>
+<value selector="suspend">suspend</value>
+<value selector="single">single</value>
+<value selector="halt">halt</value>
+</Value>
+
+<Value id="var_auditd_admin_space_left_action" type="string" >
+<title>Action for auditd to take when disk space just starts to run low</title>
+<description>The setting for space_left_action in /etc/audit/auditd.conf</description>
+<value selector="">single</value>
+<value selector="ignore">ignore</value>
+<value selector="syslog">syslog</value>
+<value selector="email">email</value>
+<value selector="exec">exec</value>
+<value selector="suspend">suspend</value>
+<value selector="single">single</value>
+<value selector="halt">halt</value>
+</Value>
+
+<Value id="var_auditd_action_mail_acct" type="string" >
+<title>Account for auditd to send email when actions occurs</title>
+<description>The setting for action_mail_acct in /etc/audit/auditd.conf</description>
+<value selector="">root</value>
+<value selector="root">root</value>
+<value selector="admin">admin</value>
+</Value>
+
+<Rule id="configure_auditd_num_logs">
+<title>Configure auditd Number of Logs Retained</title>
+<description>Determine how many log files
+<tt>auditd</tt> should retain when it rotates logs.
+Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following
+line, substituting <i>NUMLOGS</i> with an appropriate value:
+<pre>num_logs = <i>NUMLOGS</i></pre>
+The default value of 5 is recommended for general-purpose systems.  Note that
+values less than 2 result in no log rotation.</description>
+<rationale>The total storage for audit log files must be large enough to retain
+log information over the period required. This is a function of the maxium log
+file size and the number of logs retained.</rationale>
+<oval id="auditd_data_retention_num_logs" value="var_auditd_num_logs" /> 
+</Rule>
+
+
+<Rule id="configure_auditd_max_log_file">
+<title>Configure auditd Max Log File Size</title>
+<description>Determine the amount of audit data (in megabytes)
+which should be retained in each log file. Edit the file
+<tt>/etc/audit/auditd.conf</tt>. Add or modify the following line, substituting
+<i>STOREMB</i> with an appropriate value:
 <pre>max_log_file = <i>STOREMB</i></pre>
- </description>
-<oval id="auditd_retention_max_log" />
+The default value of 6 (MB) or even higher is recommended for general-purpose systems.
+Larger values, of course,
+support retention of even more audit data.</description>
+<rationale>The total storage for audit log files must be large enough to retain
+log information over the period required. This is a function of the maxium
+log file size and the number of logs retained.</rationale>
+<oval id="auditd_data_retention_max_log_file" value="var_auditd_max_log_file" /> 
 </Rule>
 
+
+<Rule id="configure_auditd_max_log_file_action">
+<title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</title>
+<description> The default action to take when the logs reach their maximum size
+is to rotate the log files, discarding the oldest one.  To configure the action taken
+by <tt>auditd</tt>, add or correct the line:
+<pre>max_log_file_action = <i>ACTION</i></pre>
+Valid values for <i>ACTION</i> are described in the <tt>auditd.conf</tt> man page, and include
+<tt>ignore</tt>, <tt>syslog</tt>, <tt>suspend</tt>, <tt>rotate</tt>,
+and <tt>keep_logs</tt>.  <br/><br/>The default (case-insensitive) setting,
+<tt>rotate</tt>, is recommended for most environments.
+</description>
+<rationale>Automatically rotating logs (by setting this to <tt>rotate</tt>)
+minimizes the chances of the system unexpectedly running out of disk space by
+being overwhelmed with log data.  However, for systems that must never discard
+log data, or which use external processes to transfer it and reclaim space,
+<tt>keep_logs</tt> can be employed.</rationale>
+<oval id="auditd_data_retention_max_log_file_action" value="var_auditd_max_log_file_action" />
+</Rule>
+
+<!--
 <Group id="auditd_logical_volume">
-<title>Configure auditd to Use Logical Volume</title>
-<description>Use a dedicated partition (or logical volume) for log files. It is straightforward to create such a partition
-or logical volume during system installation time. The partition should be larger than the maximum
-space which <tt>auditd</tt> will ever use, which is the maximum size of each log file (<tt>max_log_file</tt>) multiplied
-by the number of log files (<tt>num_logs</tt>). Ensure the partition is mounted on <tt>/var/log/audit</tt>.</description>
+<title>Configure auditd to Use a Separate Partition or Logical Volume</title>
+<description>Use a dedicated partition (or logical volume) for log files. It is
+straightforward to create such a partition or logical volume during system
+installation time. The partition should be larger than the maximum space which
+<tt>auditd</tt> will ever use, which is the maximum size of each log file
+(<tt>max_log_file</tt>) multiplied by the number of log files
+(<tt>num_logs</tt>). Ensure the partition is mounted on
+<tt>/var/log/audit</tt>.
+</description>
 </Group>
+-->
 
 <Rule id="configure_auditd_space_left_action">
 <title>Configure auditd space_left Action on Low Disk Space</title>
-<description> If your site requires that the machine be disabled when auditing cannot be performed, configure <tt>auditd</tt> to halt the system when disk space for auditing runs low. Edit <tt>/etc/audit/auditd.conf</tt>, and add or
-correct the following lines:
-<pre>space_left_action = email</pre> </description>
-<oval id="auditd_retention_space_left" />
+<description>The <tt>auditd</tt> service can be configured to take an action
+when disk space <i>starts</i> to run low. 
+Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line,
+substituting <i>ACTION</i> appropriately:
+<pre>space_left_action = <i>ACTION</i></pre>
+Valid values for <i>ACTION</i> are described in the <tt>auditd.conf</tt> man page, and include
+<tt>ignore</tt>, <tt>syslog</tt>, <tt>email</tt>, <tt>exec</tt>,
+<tt>suspend</tt>, <tt>single</tt> and <tt>halt</tt>.
+<br/><br/>
+Setting this to <tt>email</tt> is recommended over the default
+(<tt>suspend</tt>) as it may be more likely to get prompt attention.
+</description>
+<rationale>Notifying administrators of an impending disk space problem may
+allow them to take corrective action prior to any disruption.</rationale>
+<oval id="auditd_data_retention_space_left_action" value="var_auditd_space_left_action"/>
 </Rule>
 
-<Rule id="configure_auditd_action_mail_acct">
-<title>Configure auditd mail_acct Action on Low Disk Space</title>
-<description> 
-Add or correct the following line in auditd.conf to ensure that the machine is halted when disk space for auditing runs low.
-<pre>action_mail_acct = root</pre> </description>
-<oval id="auditd_retention_mail_acct" />
-</Rule>
 
 <Rule id="configure_auditd_admin_space_left_action">
 <title>Configure auditd admin_space_left Action on Low Disk Space</title>
-<description> Add or correct the following line in auditd.conf to ensure that the machine is halted when disk space for auditing runs low.
-<pre>admin_space_left_action = halt</pre> </description>
-<oval id="auditd_retention_admin_space_left" />
+<description>The <tt>auditd</tt> service can be configured to take an action
+when disk space is running low but prior to running out of space completely. 
+Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line,
+substituting <i>ACTION</i> appropriately:
+<pre>admin_space_left_action = <i>ACTION</i></pre>
+Valid values for <i>ACTION</i> include are described in the <tt>auditd.conf</tt> man page, and include
+<tt>ignore</tt>, <tt>syslog</tt>, <tt>email</tt>, <tt>exec</tt>,
+<tt>suspend</tt>, <tt>single</tt> and <tt>halt</tt>.  The default setting is
+<tt>suspend</tt>, which may not be noticed by some administrators.
+<br/><br/>
+Setting this value to <tt>single</tt> will cause the system to switch to
+single user mode for corrective action, and is recommended.
+</description>
+<rationale>Administrators should be made aware of an inability to record
+audit records.  If a separate partition or logical volume of adequate size
+is used, running low on space for audit records should never occur.
+</rationale>
+<oval id="auditd_data_retention_admin_space_left_action" value="var_auditd_admin_space_left_action" />
 </Rule>
 
-<Rule id="configure_auditd_max_log_file_action">
-<title>Configure auditd max_log_file Action to Keep Logs</title>
-<description> The default action to take when the logs reach their maximum size is to rotate the log files, discarding the
-oldest one. If it is more important to retain all possible auditing information, even if that opens the possibility
-of running out of space and taking the action defined by <tt>admin_space_left_action</tt>, add or correct the line:
-<pre>max_log_file_action = keep_logs</pre> </description>
-<oval id="auditd_retention_max_log_file" />
+
+<Rule id="configure_auditd_action_mail_acct">
+<title>Configure auditd mail_acct Action on Low Disk Space</title>
+<description>The <tt>auditd</tt> service can be configured to send email to
+a designated account in certain situations.  Add or correct the following line
+in <tt>/etc/audit/auditd.conf</tt> to ensure that administrators are notified
+via email for those situations:
+<pre>action_mail_acct = root</pre>
+</description>
+<rationale>Email sent to the root account is typically aliased to the
+administrators of the system, who can take appropriate action.</rationale>
+<oval id="auditd_data_retention_action_mail_acct" value="var_auditd_action_mail_acct" />
 </Rule>
+
 </Group>
 
 <Group id="auditd_configure_rules">
 <title>Configure <tt>auditd</tt> Rules for Comprehensive Auditing</title>
 <description>The <tt>auditd</tt> program can perform comprehensive
-monitoring of system activity. This section describes rec- ommended
+monitoring of system activity. This section describes recommended
 configuration settings for comprehensive auditing, but a full
 description of the auditing system’s capabilities is beyond the
-scope of this guide. The mailing list linux-audit at redhat.com may be
-a good source of further information.
+scope of this guide. The mailing list <i>linux-audit at redhat.com</i> exists
+to facilitate community discussion of the auditing system.
 <br /><br />
 The audit subsystem supports extensive collection of events, including:
 <br />
@@ -187,7 +336,7 @@ Auditing rules at startup are controlled by the file <tt>/etc/audit/audit.rules<
 Add rules to it to meet the auditing requirements for your organization.
 Each line in <tt>/etc/audit/audit.rules</tt> represents a series of arguments
 that can be passed to <tt>auditctl</tt> and can be individually tested
-during runtime. See documentation in <tt>/usr/share/doc/audit-VERSION</tt> and
+during runtime. See documentation in <tt>/usr/share/doc/audit-<i>VERSION</i></tt> and
 in the related man pages for more details.
 <br /><br />
 If copying any example audit rulesets from <tt>/usr/share/doc/audit-VERSION</tt>,
@@ -198,7 +347,7 @@ ensuring rules are activated as needed for the appropriate
 architecture.
 <br /><br />
 After reviewing all the rules, reading the following sections, and
-editing as needed, activate the new rules:
+editing as needed, the new rules can be activated as follows:
 <pre># service auditd restart</pre>
 </description>
 <ref disa="171,172,1115,1454,1487,1571,1589" />
@@ -234,10 +383,13 @@ to capture events that modify account changes:
 -w /etc/shadow -p wa -k audit_account_changes
 -w /etc/security/opasswd -p wa -k audit_account_changes</pre>
 </description>
-<rationale>In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. It is recommended that any unexpected users, groups, or modifications be investigated for legitimacy.</rationale>
+<rationale>In addition to auditing new user and group accounts, these watches
+will alert the system administrator(s) to any modifications. It is recommended
+that any unexpected users, groups, or modifications be investigated for
+legitimacy.</rationale>
 <ident cce="14829-6" />
 <oval id="audit_rules_usergroup_modification" />
-<ref nist="AU-2(a)" disa="18,1403,1404,1405, 1684"/>
+<ref nist="AU-2(a)" disa="18,1403,1404,1405,1684"/>
 </Rule>
 
 <Rule id="audit_network_modifications">
@@ -251,8 +403,9 @@ ARCH to either b32 or b64 as appropriate for your system:
 -w /etc/hosts -p wa -k audit_network_modifications
 -w /etc/sysconfig/network -p wa -k audit_network_modifications</pre>
 </description>
-<rationale>The network environment should not be modified by anything other than
-administrator action. Any change to network parameters should be audited.</rationale>
+<rationale>The network environment should not be modified by anything other
+than administrator action. Any change to network parameters should be
+audited.</rationale>
 <ident cce="14816-3" />
 <oval id="audit_rules_networkconfig_modification" />
 <ref nist="AU-2(a)" />
@@ -266,8 +419,9 @@ Controls</title>
 <pre>-w /etc/selinux/ -p wa -k MAC-policy</pre>
 </description>
 <!-- TODO add info for selinux system calls which load new policy? -->
-<rationale>The system's mandatory access policy (SELinux) should not be arbitrarily changed by
-anything other than administrator action. All changes to MAC policy should be audited.</rationale>
+<rationale>The system's mandatory access policy (SELinux) should not be
+arbitrarily changed by anything other than administrator action. All changes to
+MAC policy should be audited.</rationale>
 <ident cce="14821-3" />
 <oval id="audit_rules_mac_modification" />
 <ref nist="AU-2" />
@@ -278,11 +432,11 @@ anything other than administrator action. All changes to MAC policy should be au
 <description> 
 The audit system already collects login info for all users and root. To watch for attempted manual edits of
 files involved in storing logon events, add the following to <tt>/etc/audit/audit.rules</tt>:
-<pre>
--w /var/log/faillog -p wa -k logins 
--w /var/log/lastlog -p wa -k logins 
-</pre>
+<pre>-w /var/log/faillog -p wa -k logins 
+-w /var/log/lastlog -p wa -k logins</pre>
 </description> 
+<rationale>Manual editing of these files may indicate nefarious activity, such
+as an attacker attempting to remove evidence of an intrusion.  </rationale>
 <ident cce="14904-7" />
 <oval id="audit_rules_login_events" />
 <!--<ref nist="TODO" />-->
@@ -290,15 +444,16 @@ files involved in storing logon events, add the following to <tt>/etc/audit/audi
 
 <Rule id="audit_manual_session_edits">
 <title> Record Attempts to Alter Process and Session Initiation Information</title>
-<description>
-The audit system already collects process information for all users and root. To watch for attempted manual
-edits of files involved in storing such process information, add the following to <tt>/etc/audit/audit.rules</tt>:
-<pre>
--w /var/run/utmp -p wa -k session
+<description> The audit system already collects process information for all
+users and root. To watch for attempted manual edits of files involved in
+storing such process information, add the following to
+<tt>/etc/audit/audit.rules</tt>:
+<pre>-w /var/run/utmp -p wa -k session
 -w /var/log/btmp -p wa -k session
--w /var/log/wtmp -p wa -k session
-</pre>
+-w /var/log/wtmp -p wa -k session</pre>
 </description>
+<rationale>Manual editing of these files may indicate nefarious activity, such
+as an attacker attempting to remove evidence of an intrusion.</rationale>
 <ident cce="14679-5" />
 <oval id="audit_rules_session_events" />
 <!--<ref nist="TODO" />-->
@@ -349,10 +504,19 @@ these events could serve as evidence of potential system compromise.</rationale>
 <Rule id="audit_privileged_commands">
 <title>Ensure <tt>auditd</tt> Collects Information on the Use of Privileged Commands</title>
 <description>At a minimum the audit system should collect the
-execution of privileged commands for all users and root. Add the
-following to <tt>/etc/audit/audit.rules</tt>:
-<pre>-a always,exit -F path=/bin/ping -F perm=x -F auid&gt;=500 -F auid!=4294967295 -k privileged</pre>
+execution of privileged commands for all users and root. 
+To find the relevant setuid programs:
+<pre># find / -type f -perm -4000 -o -perm -2000 2>/dev/null</pre>
+Then, for each setuid program on the system, add a line of the following form to 
+<tt>/etc/audit/audit.rules</tt>, where <i>SETUID_PROG_PATH</i> is the full path to each setuid program
+in the list:
+<pre>-a always,exit -F path=<i>SETUID_PROG_PATH</i> -F perm=x -F auid&gt;=500 -F auid!=4294967295 -k privileged</pre>
 </description>
+<rationale>Privileged programs are subject to escalation-of-privilege attacks,
+which attempt to subvert their normal role of providing some necessary but
+limited capability.  As such, motivation exists to monitor these programs for
+unusual activity.
+</rationale>
 <ident cce="14296-8" />
 <oval id="audit_rules_privileged_commands" />
 <ref nist="AU-2" />
@@ -432,8 +596,10 @@ to make the configuration immutable:
 <pre>-e 2</pre>
 With this setting, a reboot will be required to change any
 audit rules.</description>
-<rationale>Making the audit configuration immutable prevents the accidential as
-well as malicious modification of the audit rules.</rationale>
+<rationale>Making the audit configuration immutable prevents accidential as
+well as  malicious modification of the audit rules, although it may be
+problematic if legitimate changes are needed during system
+operation</rationale>
 <ident cce="14692-8" />
 <oval id="audit_rules_immutable" />
 <ref nist="AU-2" />
-- 
1.7.1



More information about the scap-security-guide mailing list