[PATCH 1/1] Broke apart auditd rules/prose for time changes

Kevin Spargur kspargur at redhat.com
Mon Jun 18 14:28:23 UTC 2012


Signed-off-by: Kevin Spargur <kspargur at redhat.com>
---
 .../src/input/checks/audit_rules_time_adjtimex.xml |   57 +++++++++
 .../checks/audit_rules_time_clock_settime.xml      |   57 +++++++++
 .../input/checks/audit_rules_time_settimeofday.xml |   57 +++++++++
 rhel6/src/input/checks/audit_rules_time_stime.xml  |   41 +++++++
 .../checks/audit_rules_time_watch_localtime.xml    |   33 +++++
 .../input/checks/system_info_architecture_x86.xml  |   30 +++++
 .../checks/system_info_architecture_x86_64.xml     |   30 +++++
 rhel6/src/input/profiles/common.xml                |    8 +-
 rhel6/src/input/system/auditing.xml                |  126 ++++++++++++++++++--
 9 files changed, 427 insertions(+), 12 deletions(-)
 create mode 100644 rhel6/src/input/checks/audit_rules_time_adjtimex.xml
 create mode 100644 rhel6/src/input/checks/audit_rules_time_clock_settime.xml
 create mode 100644 rhel6/src/input/checks/audit_rules_time_settimeofday.xml
 create mode 100644 rhel6/src/input/checks/audit_rules_time_stime.xml
 create mode 100644 rhel6/src/input/checks/audit_rules_time_watch_localtime.xml
 create mode 100644 rhel6/src/input/checks/system_info_architecture_x86.xml
 create mode 100644 rhel6/src/input/checks/system_info_architecture_x86_64.xml

diff --git a/rhel6/src/input/checks/audit_rules_time_adjtimex.xml b/rhel6/src/input/checks/audit_rules_time_adjtimex.xml
new file mode 100644
index 0000000..7d47206
--- /dev/null
+++ b/rhel6/src/input/checks/audit_rules_time_adjtimex.xml
@@ -0,0 +1,57 @@
+<def-group>
+  <definition class="compliance"
+  id="audit_rules_time_adjtimex" version="1">
+    <metadata>
+      <title>Record Attempts to Alter Time Through Adjtimex</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-14051-7" source="CCE" />
+      <description>Record attempts to alter time through adjtimex.
+      </description>
+    </metadata>
+    <criteria comment="Test for either..." operator="OR">
+      <criteria comment="both..." operator="AND">
+        <extend_definition comment="32bit and ..." 
+        definition_ref="system_info_architecture_x86" />
+        <criterion comment="32bit line adjtimex and key present"
+        test_ref="test_audit_rules_time_adjtimex_x86" />
+      </criteria>
+      <criteria comment="both ..." operator="AND">
+        <extend_definition comment="64bit and ..." 
+        definition_ref="system_info_architecture_x86_64" />
+        <criterion comment="64bit line for adjtimex and key present"
+        test_ref="test_audit_rules_time_adjtimex_x86_64" />
+      </criteria>
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all"
+  check_existence="at_least_one_exists"
+  comment="Tests the for presence of 32bit -S adjtime and key"
+  id="test_audit_rules_time_adjtimex_x86" version="1">
+    <ind:object object_ref="obj_audit_rules_time_adjtimex_x86" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_audit_rules_time_adjtimex_x86"
+  version="1">
+    <ind:path>/etc/audit</ind:path>
+    <ind:filename>audit.rules</ind:filename>
+    <ind:pattern 
+    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+-F[\s]+arch=b32.*-S[\s]+adjtimex[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all"
+  check_existence="at_least_one_exists"
+  comment="Tests the for presence of 64bit -S adjtime and key"
+  id="test_audit_rules_time_adjtimex_x86_64" version="1">
+    <ind:object object_ref="obj_audit_rules_time_adjtimex_x86_64" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_audit_rules_time_adjtimex_x86_64"
+  version="1">
+    <ind:path>/etc/audit</ind:path>
+    <ind:filename>audit.rules</ind:filename>
+    <ind:pattern 
+    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+-F[\s]+arch=b64.*-S[\s]+adjtimex[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/audit_rules_time_clock_settime.xml b/rhel6/src/input/checks/audit_rules_time_clock_settime.xml
new file mode 100644
index 0000000..58fecc8
--- /dev/null
+++ b/rhel6/src/input/checks/audit_rules_time_clock_settime.xml
@@ -0,0 +1,57 @@
+<def-group>
+  <definition class="compliance"
+  id="audit_rules_time_clock_settime" version="1">
+    <metadata>
+      <title>Record Attempts to Alter Time Through Clock_settime</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-14051-7" source="CCE" />
+      <description>Record attempts to alter time through clock_settime.
+      </description>
+    </metadata>
+    <criteria comment="Test for either..." operator="OR">
+      <criteria comment="both..." operator="AND">
+        <extend_definition comment="32bit and ..." 
+        definition_ref="system_info_architecture_x86" />
+        <criterion comment="32bit line clock_settime and key present"
+        test_ref="test_audit_rules_time_clock_settime_x86" />
+      </criteria>
+      <criteria comment="both ..." operator="AND">
+        <extend_definition comment="64bit and ..." 
+        definition_ref="system_info_architecture_x86_64" />
+        <criterion comment="64bit line for clock_settime and key present"
+        test_ref="test_audit_rules_time_clock_settime_x86_64" />
+      </criteria>
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all"
+  check_existence="at_least_one_exists"
+  comment="Tests the for presence of 32bit -S clock_settime and key"
+  id="test_audit_rules_time_clock_settime_x86" version="1">
+    <ind:object object_ref="obj_audit_rules_time_clock_settime_x86" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_audit_rules_time_clock_settime_x86"
+  version="1">
+    <ind:path>/etc/audit</ind:path>
+    <ind:filename>audit.rules</ind:filename>
+    <ind:pattern 
+    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+-F[\s]+arch=b32.*-S[\s]+clock_settime[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all"
+  check_existence="at_least_one_exists"
+  comment="Tests the for presence of 64bit -S clock_settime and key"
+  id="test_audit_rules_time_clock_settime_x86_64" version="1">
+    <ind:object object_ref="obj_audit_rules_time_clock_settime_x86_64" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_audit_rules_time_clock_settime_x86_64"
+  version="1">
+    <ind:path>/etc/audit</ind:path>
+    <ind:filename>audit.rules</ind:filename>
+    <ind:pattern 
+    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+-F[\s]+arch=b64.*-S[\s]+clock_settime[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/audit_rules_time_settimeofday.xml b/rhel6/src/input/checks/audit_rules_time_settimeofday.xml
new file mode 100644
index 0000000..2ab39b1
--- /dev/null
+++ b/rhel6/src/input/checks/audit_rules_time_settimeofday.xml
@@ -0,0 +1,57 @@
+<def-group>
+  <definition class="compliance"
+  id="audit_rules_time_settimeofday" version="1">
+    <metadata>
+      <title>Record Attempts to Alter Time Through Settimeofday</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-14051-7" source="CCE" />
+      <description>Record attempts to alter time through settimeofday.
+      </description>
+    </metadata>
+    <criteria comment="Test for either..." operator="OR">
+      <criteria comment="both..." operator="AND">
+        <extend_definition comment="32bit and ..." 
+        definition_ref="system_info_architecture_x86" />
+        <criterion comment="32bit line settimeofday and key present"
+        test_ref="test_audit_rules_time_settimeofday_x86" />
+      </criteria>
+      <criteria comment="both ..." operator="AND">
+        <extend_definition comment="64bit and ..." 
+        definition_ref="system_info_architecture_x86_64" />
+        <criterion comment="64bit line for settimeofday and key present"
+        test_ref="test_audit_rules_time_settimeofday_x86_64" />
+      </criteria>
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all"
+  check_existence="at_least_one_exists"
+  comment="Tests the for presence of 32bit -S settimeofday and key"
+  id="test_audit_rules_time_settimeofday_x86" version="1">
+    <ind:object object_ref="obj_audit_rules_time_settimeofday_x86" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_audit_rules_time_settimeofday_x86"
+  version="1">
+    <ind:path>/etc/audit</ind:path>
+    <ind:filename>audit.rules</ind:filename>
+    <ind:pattern 
+    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+-F[\s]+arch=b32.*-S[\s]+settimeofday[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all"
+  check_existence="at_least_one_exists"
+  comment="Tests the for presence of 64bit -S settimeofday and key"
+  id="test_audit_rules_time_settimeofday_x86_64" version="1">
+    <ind:object object_ref="obj_audit_rules_time_settimeofday_x86_64" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_audit_rules_time_settimeofday_x86_64"
+  version="1">
+    <ind:path>/etc/audit</ind:path>
+    <ind:filename>audit.rules</ind:filename>
+    <ind:pattern 
+    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+-F[\s]+arch=b64.*-S[\s]+settimeofday[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/audit_rules_time_stime.xml b/rhel6/src/input/checks/audit_rules_time_stime.xml
new file mode 100644
index 0000000..555f088
--- /dev/null
+++ b/rhel6/src/input/checks/audit_rules_time_stime.xml
@@ -0,0 +1,41 @@
+<def-group>
+  <definition class="compliance"
+  id="audit_rules_time_stime" version="1">
+    <metadata>
+      <title>Record Attempts to Alter Time Through Stime</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-14051-7" source="CCE" />
+      <description>Record attempts to alter time through stime, note that this
+ is only relevant on 32bit architecture.</description>
+    </metadata>
+    <criteria comment="Test for either..." operator="OR">
+      <criteria comment="both..." operator="AND">
+        <extend_definition comment="32bit and ..." 
+        definition_ref="system_info_architecture_x86" />
+        <criterion comment="32bit line stime and key present"
+        test_ref="test_audit_rules_time_stime_x86" />
+      </criteria>
+      <criteria comment="both ...">
+        <extend_definition comment="64bit and ..." 
+        definition_ref="system_info_architecture_x86_64" />
+      </criteria>
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all"
+  check_existence="at_least_one_exists"
+  comment="Tests the for presence of 32bit -S stime and key"
+  id="test_audit_rules_time_stime_x86" version="1">
+    <ind:object object_ref="obj_audit_rules_time_stime_x86" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_audit_rules_time_stime_x86"
+  version="1">
+    <ind:path>/etc/audit</ind:path>
+    <ind:filename>audit.rules</ind:filename>
+    <ind:pattern 
+    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+-F[\s]+arch=b32.*-S[\s]+stime[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/audit_rules_time_watch_localtime.xml b/rhel6/src/input/checks/audit_rules_time_watch_localtime.xml
new file mode 100644
index 0000000..77a5c1f
--- /dev/null
+++ b/rhel6/src/input/checks/audit_rules_time_watch_localtime.xml
@@ -0,0 +1,33 @@
+<def-group>
+  <definition class="compliance"
+  id="audit_rules_time_watch_localtime" version="1">
+    <metadata>
+      <title>Record Attempts to Alter Time Through the Localtime File</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-14051-7" source="CCE" />
+      <description>Record attempts to alter time through /etc/localtime
+      </description>
+    </metadata>
+    <criteria comment="Test for localtime file being watched" >
+      <criterion comment="watch localtime file"
+      test_ref="test_audit_rules_time_watch_localtime" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all"
+  check_existence="at_least_one_exists"
+  comment="Tests the for presence etc localtime file in the rules file"
+  id="test_audit_rules_time_watch_localtime" version="1">
+    <ind:object object_ref="obj_audit_rules_time_watch_localtime" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_audit_rules_time_watch_localtime"
+  version="1">
+    <ind:path>/etc/audit</ind:path>
+    <ind:filename>audit.rules</ind:filename>
+    <ind:pattern 
+    operation="pattern match">^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/system_info_architecture_x86.xml b/rhel6/src/input/checks/system_info_architecture_x86.xml
new file mode 100644
index 0000000..894e499
--- /dev/null
+++ b/rhel6/src/input/checks/system_info_architecture_x86.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="miscellaneous"
+  id="system_info_architecture_x86" version="1">
+<!-- Note that this does not meet requirements for class=inventory as that 
+only tests for patches per 5.10.1 Revision 1 -->
+    <metadata>
+      <title>Test for x86 Architecture</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>Generic test for x86 architecture to be used by other tests</description>
+    </metadata>
+    <criteria>
+      <criterion comment="Generic test for x86 architecture"
+      test_ref="test_system_info_architecture_x86" />
+    </criteria>
+  </definition>
+  <unix:uname_test check="all" 
+  comment="32 bit architecture" 
+  id="test_system_info_architecture_x86" 
+  version="1">
+    <unix:object object_ref="object_system_info_architecture_x86" />
+    <unix:state state_ref="state_system_info_architecture_x86" />
+  </unix:uname_test>
+  <unix:uname_object comment="32 bit architecture" id="object_system_info_architecture_x86" version="1">
+  </unix:uname_object>
+  <unix:uname_state comment="32 bit architecture" id="state_system_info_architecture_x86" version="1">
+    <unix:processor_type operation="equals">x86</unix:processor_type>
+  </unix:uname_state>
+</def-group>
diff --git a/rhel6/src/input/checks/system_info_architecture_x86_64.xml b/rhel6/src/input/checks/system_info_architecture_x86_64.xml
new file mode 100644
index 0000000..0019a49
--- /dev/null
+++ b/rhel6/src/input/checks/system_info_architecture_x86_64.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="miscellaneous"
+  id="system_info_architecture_x86_64" version="1">
+<!-- Note that this does not meet requirements for class=inventory as that 
+     only tests for patches per 5.10.1 Revision 1 -->
+    <metadata>
+      <title>Test for x86_64 Architecture</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>Generic test for x86_64 architecture to be used by other tests</description>
+    </metadata>
+    <criteria>
+      <criterion comment="Generic test for x86_64 architecture"
+      test_ref="test_system_info_architecture_x86_64" />
+    </criteria>
+  </definition>
+  <unix:uname_test check="all" 
+  comment="64 bit architecture" 
+  id="test_system_info_architecture_x86_64" 
+  version="1">
+    <unix:object object_ref="object_system_info_architecture_x86_64" />
+    <unix:state state_ref="state_system_info_architecture_x86_64" />
+  </unix:uname_test>
+  <unix:uname_object comment="64 bit architecture" id="object_system_info_architecture_x86_64" version="1">
+  </unix:uname_object>
+  <unix:uname_state comment="64 bit architecture" id="state_system_info_architecture_x86_64" version="1">
+    <unix:processor_type operation="equals">x86_64</unix:processor_type>
+  </unix:uname_state>
+</def-group>
diff --git a/rhel6/src/input/profiles/common.xml b/rhel6/src/input/profiles/common.xml
index cb6024f..1b188da 100644
--- a/rhel6/src/input/profiles/common.xml
+++ b/rhel6/src/input/profiles/common.xml
@@ -88,7 +88,13 @@
 <select idref="configure_auditd_max_log_file_action" selected="true"/>
 <select idref="configure_auditd_admin_space_left_action" selected="true"/>
 
-<select idref="audit_time_rules" selected="true"/>
+<!-- <select idref="audit_time_rules" selected="true"/> -->
+<select idref="audit_rules_time_adjtimex" selected="true"/>
+<select idref="audit_rules_time_settimeofday" selected="true"/>
+<select idref="audit_rules_time_stime" selected="true"/>
+<select idref="audit_rules_time_clock_settime" selected="true"/>
+<select idref="audit_rules_time_watch_localtime" selected="true"/>
+
 <select idref="audit_account_changes" selected="true"/>
 <select idref="audit_network_modifications" selected="true"/>
 <select idref="audit_mac_changes" selected="true"/>
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 62e0f24..746e1c9 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -354,25 +354,129 @@ editing as needed, the new rules can be activated as follows:
 </description>
 <ref disa="171,172,1115,1454,1487,1571,1589,880" />
 
-<Rule id="audit_time_rules">
+<Group id="audit_time_rules">
 <title>Records Events that Modify Date and Time Information</title>
+<description>Arbitrary changes to the system time can be used to obfuscate 
+nefarious activites in log files as well as to confuse network services that 
+are highly dependent upon an accurate system time. All changes to the system 
+time should be audited.</description>
+
+<Rule id="audit_rules_time_adjtimex">
+<title>Record attempts to alter time through adjtimex</title>
+<description>On a 32-bit system, add the following to <tt>/etc/audit/audit.rules</tt>:
+<pre># audit_time_rules
+-a always,exit -F arch=b32 -S adjtimex -k audit_time_rules</pre>
+On a 64-bit system, add the following to <tt>/etc/audit/audit.rules</tt>:
+<pre># audit_time_rules
+-a always,exit -F arch=b64 -S adjtimex -k audit_time_rules</pre>
+The -k option allows for the specification of a key in string form that can 
+be used for better reporting capability through ausearch and aureport.  
+Multiple system calls can be defined on the same line to save space if 
+desired, but is not required.  See an example of multiple combined syscalls:
+<pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
+-k audit_time_rules</pre>
+</description>
+<rationale>Arbitrary changes to the system time can be used to obfuscate 
+nefarious activites in log files as well as to confuse network services that 
+are highly dependent upon an accurate system time (such as sshd). All changes 
+to the system time should be audited.</rationale>
+<ident cce="14051-7" />
+<oval id="audit_rules_time_adjtimex" />
+<ref nist="AU-2(a)" />
+<ref disa="1487,169" />
+</Rule>
+
+<Rule id="audit_rules_time_settimeofday">
+<title>Record attempts to alter time through settimeofday</title>
+<description>On a 32-bit system, add the following to <tt>/etc/audit/audit.rules</tt>:
+<pre># audit_time_rules
+-a always,exit -F arch=b32 -S settimeofday -k audit_time_rules</pre>
+On a 64-bit system, add the following to <tt>/etc/audit/audit.rules</tt>:
+<pre># audit_time_rules
+-a always,exit -F arch=b64 -S settimeofday -k audit_time_rules</pre>
+The -k option allows for the specification of a key in string form that can 
+be used for better reporting capability through ausearch and aureport.  
+Multiple system calls can be defined on the same line to save space if 
+desired, but is not required.  See an example of multiple combined syscalls:
+<pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
+-k audit_time_rules</pre>
+</description>
+<rationale>Arbitrary changes to the system time can be used to obfuscate 
+nefarious activites in log files as well as to confuse network services that 
+are highly dependent upon an accurate system time (such as sshd). All changes 
+to the system time should be audited.</rationale>
+<ident cce="14051-7" />
+<oval id="audit_rules_time_settimeofday" />
+<ref nist="AU-2(a)" />
+<ref disa="1487,169" />
+</Rule>
+
+<Rule id="audit_rules_time_stime">
+<title>Record attempts to alter time through stime</title>
 <description>On a 32-bit system, add the following to <tt>/etc/audit/audit.rules</tt>:
 <pre># audit_time_rules
--a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -k audit_time_rules
--w /etc/localtime -p wa -k audit_time_rules</pre>
-On a 64-bit system, add the following to <tt>/etc/audit/audit.rules</tt> (note the lack
-of <tt>-S stime</tt>, which is not relevant for a 64-bit installation):
+-a always,exit -F arch=b32 -S stime -k audit_time_rules</pre>
+On a 64-bit system, the "-S time" is not necessary.  The -k option allows for 
+the specification of a key in string form that can be used for better 
+reporting capability through ausearch and aureport.  Multiple system calls 
+can be defined on the same line to save space if desired, but is not required.
+See an example of multiple combined syscalls:
+<pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
+-k audit_time_rules</pre>
+</description>
+<rationale>Arbitrary changes to the system time can be used to obfuscate 
+nefarious activites in log files as well as to confuse network services that 
+are highly dependent upon an accurate system time (such as sshd). All changes 
+to the system time should be audited.</rationale>
+<ident cce="14051-7" />
+<oval id="audit_rules_time_stime" />
+<ref nist="AU-2(a)" />
+<ref disa="1487,169" />
+</Rule>
+
+<Rule id="audit_rules_time_clock_settime">
+<title>Record attempts to alter time through clock_settime</title>
+<description>On a 32-bit system, add the following to <tt>/etc/audit/audit.rules</tt>:
 <pre># audit_time_rules
--a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rules
--w /etc/localtime -p wa -k audit_time_rules</pre>
+-a always,exit -F arch=b32 -S clock_settime -k audit_time_rules</pre>
+On a 64-bit system, add the following to <tt>/etc/audit/audit.rules</tt>:
+<pre># audit_time_rules
+-a always,exit -F arch=b64 -S clock_settime -k audit_time_rules</pre>
+The -k option allows for the specification of a key in string form that can 
+be used for better reporting capability through ausearch and aureport.  
+Multiple system calls can be defined on the same line to save space if 
+desired, but is not required.  See an example of multiple combined syscalls:
+<pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
+-k audit_time_rules</pre>
+</description>
+<rationale>Arbitrary changes to the system time can be used to obfuscate 
+nefarious activites in log files as well as to confuse network services that 
+are highly dependent upon an accurate system time (such as sshd). All changes 
+to the system time should be audited.</rationale>
+<ident cce="14051-7" />
+<oval id="audit_rules_time_clock_settime" />
+<ref nist="AU-2(a)" />
+<ref disa="1487,169" />
+</Rule>
+
+<Rule id="audit_rules_time_watch_localtime">
+<title>Record attempts to alter the localtime file</title>
+<description>Add the following to <tt>/etc/audit/audit.rules</tt>:
+<pre>-w /etc/localtime -p wa -k audit_time_rules</pre>
+The -k option allows for the specification of a key in string form that can 
+be used for better reporting capability through ausearch and aureport and
+should always be used.  
 </description>
-<rationale>Arbitrary changes to the system time can be used to obfuscate nefarious
-activites in log files as well as to confuse network services that are highly dependent
-upon an accurate system time (such as sshd). All changes to the system time should be audited.</rationale>
+<rationale>Arbitrary changes to the system time can be used to obfuscate 
+nefarious activites in log files as well as to confuse network services that 
+are highly dependent upon an accurate system time (such as sshd). All changes 
+to the system time should be audited.</rationale>
 <ident cce="14051-7" />
-<oval id="audit_rules_record_timechange" />
+<oval id="audit_rules_time_watch_localtime" />
 <ref nist="AU-2(a)" />
+<ref disa="1487,169" />
 </Rule>
+</Group><!--End <Group id="audit_time_rules"> -->
 
 <Rule id="audit_account_changes">
 <title>Record Events that Modify User/Group Information</title>
-- 
1.7.7.6



More information about the scap-security-guide mailing list