[RHEL/6] Modify auditd.conf checking rules
Jan Lieskovsky
jlieskov at redhat.com
Wed Mar 12 18:12:28 UTC 2014
Hello folks,
as noted in https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426
nv_split() procedure definition, auditd when parsing / loading its configuration file
content:
https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L279
uses nv_split() routine to check if:
* the name-value pair contains only space as the only one allowed delimiter
(https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L442)
* if there's at least one space before and after the equal sign / character.
Based on the above (only space as delimiter, at least one required before and after '='
character, no comments allowed) this patch changes the existing auditd rules touching
/etc/audit/auditd.conf configuration file, so the rules wouldn't return pass in case,
the configuration file would be invalid (auditd would refuse to start). For example
in case the "num_logs" line would look like:
^\tnum_logs\t=\t5\t$
The proposed patch has been tested (all of the rules the change touches) on RHEL-6
and seems to be working properly.
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
P.S.: This is not an attempt underlying OVAL checks to replace auditd.conf configuration
file sanity checking (since auditd will do at service start / restart anyway). But on
the other hand the check should not pass (even when having expected config variable
settings according to currently selected profile) when the particular line in auditd
config does not meet the auditd configuration file format requirements (auditd would
refuse to start in such configuration). So pre-avoid the confusion that might arise
(OVAL check returning pass, but auditd refusing to start) by requiring particular lines
to be in format, as accepted by auditd (space char the only delimiter, space required
around '=' etc.)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-RHEL-6-Modify-auditd.conf-checking-rules-to.patch
Type: text/x-patch
Size: 12223 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140312/54276bc8/attachment-0001.bin>
More information about the scap-security-guide
mailing list