auditing gnome use of elevated privileges (e.g. reboot/shutdown)?

Robert Jacobson Robert.C.Jacobson at nasa.gov
Fri Nov 6 19:39:36 UTC 2015


On 2015-11-06 1:28 PM, Steve Grubb wrote:
> That said, you can audit some things by placing a watch on specific
> helpers in /usr/libexec. -Steve 

Can you expand on that a bit?  I have no idea which helpers gnome might
use for a reboot operation.

I tried this rule just for fun:

-w /usr/libexec -p rwxa -k libexec

But I didn't see anything related to power when I rebooted the system
via Gnome.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Robert Jacobson               Robert.C.Jacobson at nasa.gov
Lead System Admin       Solar Dynamics Observatory (SDO)
Bldg 14, E222                             (301) 286-1591 



More information about the scap-security-guide mailing list