<div dir="ltr"><div><div><div>All,<br><br>I've been running in compliance with this rule for quite some time now and I'm noticing that the amount of noise that it produces is simply outrageous.<br><br></div>The suggestion is:<br>
<br>At a minimum the audit system should collect file permission changes for
all users and root. Add the following to "/etc/audit/audit.rules": <br><br>-a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 \<br>-k perm_mod<br><br>If the system is 64 bit then also add the following: <br>
<br>-a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 \<br>-k perm_mod<br><br></div>And here is the output of a normal workstation over about a week of auditing and normal usage:<br><br>Syscall Summary Report<br>
==========================<br>total syscall<br>==========================<br>24907 chmod<br>15870 chown<br>11169 rename<br>7409 open<br>6462 fchmod<br>5290 fchown<br>3687 umount2<br>1443 setsid<br>1166 fsetxattr<br>
869 removexattr<br>456 adjtimex<br>360 fchmodat<br>337 lchown<br>211 setuid<br>69 mkdir<br>63 setsockopt<br>33 unlink<br>22 setxattr<br>20 clone<br>19 execve<br>7 fchownat<br>7 mount<br>7 creat<br>4 close<br>
4 ioctl<br>3 symlink<br>2 mknod<br>1 rmdir<br>1 lsetxattr<br>1 clock_settime<br>1 capset<br><br></div>So, I get why this can be useful. But I'm not so sure that it's useful to know that Pidgin dropped a new temp file every few minutes or that, each time I open a file (and write a temp file), that I did this as a normal user.<br>
<br>I just can't see the practicality of going through those top three calls on a regular basis.<br><br>I'm not necessarily suggesting that this type of thing be dropped but I'd like to understand how auditors won't fall into just ignoring them completely.<br>
<br>Thoughts?<br clear="all"><div><div><div><div><div><br></div><div>Thanks,<br><br>Trevor<br></div><div>-- <br>Trevor Vaughan<br>Vice President, Onyx Point, Inc<br>(410) 541-6699<br><a href="mailto:tvaughan@onyxpoint.com">tvaughan@onyxpoint.com</a><br>
<br>-- This account not approved for unencrypted proprietary information --
</div></div></div></div></div></div>