[RHEL/6] Modify auditd.conf checking rules

Jan Lieskovsky jlieskov at redhat.com
Wed Mar 12 18:12:28 UTC 2014


Hello folks,

  as noted in https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426
nv_split() procedure definition, auditd when parsing / loading its configuration file
content:
  https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L279

uses nv_split() routine to check if:
* the name-value pair contains only space as the only one allowed delimiter
  (https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L442)
* if there's at least one space before and after the equal sign / character.

Based on the above (only space as delimiter, at least one required before and after '='
character, no comments allowed) this patch changes the existing auditd rules touching
/etc/audit/auditd.conf configuration file, so the rules wouldn't return pass in case,
the configuration file would be invalid (auditd would refuse to start). For example
in case the "num_logs" line would look like:

  ^\tnum_logs\t=\t5\t$

The proposed patch has been tested (all of the rules the change touches) on RHEL-6
and seems to be working properly.

Please review.

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

P.S.: This is not an attempt underlying OVAL checks to replace auditd.conf configuration
      file sanity checking (since auditd will do at service start / restart anyway). But on
      the other hand the check should not pass (even when having expected config variable
      settings according to currently selected profile) when the particular line in auditd
      config does not meet the auditd configuration file format requirements (auditd would
      refuse to start in such configuration). So pre-avoid the confusion that might arise
      (OVAL check returning pass, but auditd refusing to start) by requiring particular lines
      to be in format, as accepted by auditd (space char the only delimiter, space required
      around '=' etc.)
      
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-RHEL-6-Modify-auditd.conf-checking-rules-to.patch
Type: text/x-patch
Size: 12223 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140312/54276bc8/attachment-0001.bin>


More information about the scap-security-guide mailing list