Suggestion for RHEL-06-000198

Kurt Seifried kseifried at redhat.com
Fri Jun 28 06:51:57 UTC 2013


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 06/27/2013 04:34 PM, Trevor Vaughan wrote:
> All,
> 
> Currently the remediation text for RHEL-06-000198 reads as:
> 
> At a minimum the audit system should collect the execution of
> privileged commands for all users and root. To find the relevant
> setuid programs:
> 
> # find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null
> 
> Then, for each setuid program on the system, add a line of the 
> following form to "/etc/audit/audit.rules", where
> [SETUID_PROG_PATH] is the full path to each setuid program in the
> list:
> 
> -a always,exit -F path=[SETUID_PROG_PATH] -F perm=x -F auid>=500
> -F auid!=4294967295 -k privileged
> 
> I would like to suggest that this be changed to
> 
> Add the following to audit.rules: -a always,exit -F arch=b64 -F
> euid=0 -F uid!=0 -S execve -k suid-root-exec -a always,exit -F
> arch=b64 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec -a
> always,exit -F arch=b32 -F euid=0 -F uid!=0 -S execve -k
> suid-root-exec -a always,exit -F arch=b32 -F egid=0 -F gid!=0 -S
> execve -k sgid-root-exec

Wouldn't this miss a lot of interesting setgid/setuid to non root user
programs? Whereas the above mentioned fine +4000/+2000 will catch ALL
the currently existing setuid/setgid binaries. Probably best to use both.

> From my testing, this appears to catch the execution of all
> suid/sgit binaries without digging all over the system to figure
> out what they are. As an added bonus, you get to find out about
> binaries that pop onto your system for a brief period.
> 
> Thanks,
> 
> Trevor -- Trevor Vaughan Vice President, Onyx Point, Inc (410)
> 541-6699 tvaughan at onyxpoint.com <mailto:tvaughan at onyxpoint.com>

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRzTKNAAoJEBYNRVNeJnmTAJAP/ixksl5ZPbFAF0t/wusT/5iy
JuE27qDqbo0tav3MFe97h5IfdphkDN67M/La4QhWhsakE+KwbRCB6Ckwztf2GEQo
J97sYLkN4jpmFuNA77am0u0N/6kjfhiKVrBnyLEFosvFUvouOAPMWU8lLJ14hfDw
MgjefhwlgfKvyskfei/5LpspPj87GeVcir4jULdxhWnSlPWua1WViq9bwxU5PDKE
O/1OkLbCeQXfuqZAv6Ol2bXBuBNYuEY9LZOUB0xrpRYBNBAXzPp7dftOlFvUsLL9
uBwJyNjxPY2XhsYCWTdu5OCivoKz5mi3Igkp+VdQFmSkJOeGybBeuBXVaTeLVjco
wOMsezdRSgs1z4E7DhiDJxLlDxXbsbcxcbiVZGHLL5t4Ei7ho0+ex4QqZEgeM2EJ
L8f7YbbDEAE6OUsQgWgNnPvE6iAayrQkoaUZby0NGV5wmJ7dBr6QgGQFUqvXtKv7
HnQRH4l4QWLgA0zXjNTM/LvrmgsnHdBRobF9+uNlKlQpDwhC0OztznN1iuPSv2RU
D8/jOQgyrnXf5lwcXGeL9aY35l2UhpcR3Hjk8uvJltekzmKXdfpUtnNpJ85xl+vb
elEJiMiU8k1nLYttJwa81gh+wjb6CE6cSier8oxt3A8NPRcZDdIlTlBa8NqH4Rn+
ZDrwS6WGuofMdmiGUFky
=Xs9G
-----END PGP SIGNATURE-----


More information about the scap-security-guide mailing list