Suggestion for RHEL-06-000198

Steve Grubb sgrubb at redhat.com
Fri Jun 28 14:59:00 UTC 2013


On Thursday, June 27, 2013 06:34:31 PM Trevor Vaughan wrote:
> All,
> 
> Currently the remediation text for RHEL-06-000198 reads as:
> 
> At a minimum the audit system should collect the execution of privileged
> commands for all users and root. To find the relevant setuid programs:
> 
>   # find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null
> 
>   Then, for each setuid program on the system, add a line of the following
> form to "/etc/audit/audit.rules", where [SETUID_PROG_PATH] is the full path
> to each setuid program in the list:
> 
>   -a always,exit -F path=[SETUID_PROG_PATH] -F perm=x -F auid>=500 -F
> auid!=4294967295 -k privileged
> 
> I would like to suggest that this be changed to
> 
> Add the following to audit.rules:
>   -a always,exit -F arch=b64 -F euid=0 -F uid!=0 -S execve -k suid-root-exec
> -a always,exit -F arch=b64 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec
> -a always,exit -F arch=b32 -F euid=0 -F uid!=0 -S execve -k suid-root-exec
> -a always,exit -F arch=b32 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec
> 
> From my testing, this appears to catch the execution of all suid/sgit
> binaries without digging all over the system to figure out what they are.

The drawback to this method is that you have 4 rules that get evaluated for 
each and every syscall made to the kernel. Syscall rules have performance 
impacts. I would also switch out uid!=0 to auid>=500 auid!=4294967295. The 
reason being that the threat is what a user does rather than normal system 
operation.

Regarding setgid, there are no apps that are setgid root.


> As an added bonus, you get to find out about binaries that pop onto your
> system for a brief period.

Does that actually happen? World writable dirs should have -noexec mount 
option and that leaves a user's home dir as the only place that could happen 
unless an admin installs apps. /home should be mounted -nosuid so...can it 
happen?

-Steve


More information about the scap-security-guide mailing list