Suggestion for RHEL-06-000198

Trevor Vaughan tvaughan at onyxpoint.com
Thu Jun 27 22:34:31 UTC 2013


All,

Currently the remediation text for RHEL-06-000198 reads as:

At a minimum the audit system should collect the execution of privileged
commands for all users and root. To find the relevant setuid programs:

  # find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null

  Then, for each setuid program on the system, add a line of the following
form to "/etc/audit/audit.rules", where [SETUID_PROG_PATH] is the full path
to each setuid program in the list:

  -a always,exit -F path=[SETUID_PROG_PATH] -F perm=x -F auid>=500 -F
auid!=4294967295 -k privileged

I would like to suggest that this be changed to

Add the following to audit.rules:
  -a always,exit -F arch=b64 -F euid=0 -F uid!=0 -S execve -k suid-root-exec
  -a always,exit -F arch=b64 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec
  -a always,exit -F arch=b32 -F euid=0 -F uid!=0 -S execve -k suid-root-exec
  -a always,exit -F arch=b32 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec

>From my testing, this appears to catch the execution of all suid/sgit
binaries without digging all over the system to figure out what they are.
As an added bonus, you get to find out about binaries that pop onto your
system for a brief period.

Thanks,

Trevor
-- 
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan at onyxpoint.com

-- This account not approved for unencrypted proprietary information --
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130627/920e1689/attachment.html>


More information about the scap-security-guide mailing list