|
 |
44eea6 |
From 754649d2ac077e64aae4fcadfdfca30f09149687 Mon Sep 17 00:00:00 2001
|
|
|
44eea6 |
From: Watson Sato <wsato@redhat.com>
|
|
|
44eea6 |
Date: Wed, 2 Oct 2019 18:51:48 +0200
|
|
|
44eea6 |
Subject: [PATCH 1/2] Add tests for acceptable rule syntax for arufm
|
|
|
44eea6 |
|
|
|
44eea6 |
These test scenarios cover multiple valid formats for the audit rules.
|
|
|
44eea6 |
arufm stands for audit_rules_unsuccessful_file_modification
|
|
|
44eea6 |
---
|
|
|
44eea6 |
.../tests/default.fail.sh | 6 +++
|
|
|
44eea6 |
.../tests/syscalls_multiple_per_arg.pass.sh | 12 ++++++
|
|
|
44eea6 |
.../tests/syscalls_one_per_arg.pass.sh | 11 ++++++
|
|
|
44eea6 |
.../tests/syscalls_one_per_line.pass.sh | 12 ++++++
|
|
|
44eea6 |
.../tests/test_audit.rules | 39 +++++++++++++++++++
|
|
|
44eea6 |
5 files changed, 80 insertions(+)
|
|
|
44eea6 |
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/default.fail.sh
|
|
|
44eea6 |
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/syscalls_multiple_per_arg.pass.sh
|
|
|
44eea6 |
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/syscalls_one_per_arg.pass.sh
|
|
|
44eea6 |
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/syscalls_one_per_line.pass.sh
|
|
|
44eea6 |
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/test_audit.rules
|
|
|
44eea6 |
|
|
|
44eea6 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/default.fail.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/default.fail.sh
|
|
|
44eea6 |
new file mode 100644
|
|
|
44eea6 |
index 0000000000..5769121389
|
|
|
44eea6 |
--- /dev/null
|
|
|
44eea6 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/default.fail.sh
|
|
|
44eea6 |
@@ -0,0 +1,6 @@
|
|
|
44eea6 |
+#!/bin/bash
|
|
|
44eea6 |
+# profiles = xccdf_org.ssgproject.content_profile_pci-dss
|
|
|
44eea6 |
+# remediation = bash
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+rm -f /etc/audit/rules.d/*
|
|
|
44eea6 |
+> /etc/audit/audit.rules
|
|
|
44eea6 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/syscalls_multiple_per_arg.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/syscalls_multiple_per_arg.pass.sh
|
|
|
44eea6 |
new file mode 100644
|
|
|
44eea6 |
index 0000000000..ba950a6dfe
|
|
|
44eea6 |
--- /dev/null
|
|
|
44eea6 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/syscalls_multiple_per_arg.pass.sh
|
|
|
44eea6 |
@@ -0,0 +1,12 @@
|
|
|
44eea6 |
+#!/bin/bash
|
|
|
44eea6 |
+# profiles = xccdf_org.ssgproject.content_profile_pci-dss
|
|
|
44eea6 |
+# remediation = bash
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Use auditctl, on RHEL7, default is to use augenrules
|
|
|
44eea6 |
+sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+rm -f /etc/audit/rules.d/*
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Deletes everything up do "one per line"
|
|
|
44eea6 |
+# Then deletes everything from "one per arg" until end of file
|
|
|
44eea6 |
+sed '/# one per line/,/# multiple per arg/d;/# one per arg/,$d' test_audit.rules > /etc/audit/audit.rules
|
|
|
44eea6 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/syscalls_one_per_arg.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/syscalls_one_per_arg.pass.sh
|
|
|
44eea6 |
new file mode 100644
|
|
|
44eea6 |
index 0000000000..1741dad27d
|
|
|
44eea6 |
--- /dev/null
|
|
|
44eea6 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/syscalls_one_per_arg.pass.sh
|
|
|
44eea6 |
@@ -0,0 +1,11 @@
|
|
|
44eea6 |
+#!/bin/bash
|
|
|
44eea6 |
+# profiles = xccdf_org.ssgproject.content_profile_pci-dss
|
|
|
44eea6 |
+# remediation = bash
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Use auditctl, on RHEL7, default is to use augenrules
|
|
|
44eea6 |
+sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+rm -f /etc/audit/rules.d/*
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Delete everything that is between "one per line" and "one per arg"
|
|
|
44eea6 |
+sed '/# one per line/,/# one per arg/d' test_audit.rules > /etc/audit/audit.rules
|
|
|
44eea6 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/syscalls_one_per_line.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/syscalls_one_per_line.pass.sh
|
|
|
44eea6 |
new file mode 100644
|
|
|
44eea6 |
index 0000000000..5cdc0294be
|
|
|
44eea6 |
--- /dev/null
|
|
|
44eea6 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/syscalls_one_per_line.pass.sh
|
|
|
44eea6 |
@@ -0,0 +1,12 @@
|
|
|
44eea6 |
+#!/bin/bash
|
|
|
44eea6 |
+# profiles = xccdf_org.ssgproject.content_profile_pci-dss
|
|
|
44eea6 |
+# remediation = bash
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Use auditctl, on RHEL7, default is to use augenrules
|
|
|
44eea6 |
+sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+rm -f /etc/audit/rules.d/*
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Delete everything that is not between "one per line" and "multiple per arg"
|
|
|
44eea6 |
+sed '/# one per line/,/# multiple per arg/!d' test_audit.rules > /etc/audit/audit.rules
|
|
|
44eea6 |
+
|
|
|
44eea6 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/test_audit.rules b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/test_audit.rules
|
|
|
44eea6 |
new file mode 100644
|
|
|
44eea6 |
index 0000000000..0c9f7e6b61
|
|
|
44eea6 |
--- /dev/null
|
|
|
44eea6 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/tests/test_audit.rules
|
|
|
44eea6 |
@@ -0,0 +1,39 @@
|
|
|
44eea6 |
+# WARNING: Do not remove the comments in this file
|
|
|
44eea6 |
+# one per line
|
|
|
44eea6 |
+-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# multiple per arg
|
|
|
44eea6 |
+-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# one per arg
|
|
|
44eea6 |
+-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
+-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
|
|
|
44eea6 |
|
|
|
44eea6 |
From df1f092a9f0786c6137d10bb8ac440f572d4e460 Mon Sep 17 00:00:00 2001
|
|
|
44eea6 |
From: Watson Sato <wsato@redhat.com>
|
|
|
44eea6 |
Date: Wed, 2 Oct 2019 20:14:47 +0200
|
|
|
44eea6 |
Subject: [PATCH 2/2] Update regex to match multiple syscall args
|
|
|
44eea6 |
|
|
|
44eea6 |
The regex was not matching case where there were multiple '-S'
|
|
|
44eea6 |
arguments
|
|
|
44eea6 |
---
|
|
|
44eea6 |
.../template_OVAL_audit_rules_unsuccessful_file_modification | 5 +++--
|
|
|
44eea6 |
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
44eea6 |
|
|
|
44eea6 |
diff --git a/shared/templates/template_OVAL_audit_rules_unsuccessful_file_modification b/shared/templates/template_OVAL_audit_rules_unsuccessful_file_modification
|
|
|
44eea6 |
index 688c482ba4..314d7a7610 100644
|
|
|
44eea6 |
--- a/shared/templates/template_OVAL_audit_rules_unsuccessful_file_modification
|
|
|
44eea6 |
+++ b/shared/templates/template_OVAL_audit_rules_unsuccessful_file_modification
|
|
|
44eea6 |
@@ -48,12 +48,13 @@
|
|
|
44eea6 |
</criteria>
|
|
|
44eea6 |
</definition>
|
|
|
44eea6 |
|
|
|
44eea6 |
+
|
|
|
44eea6 |
|
|
|
44eea6 |
<constant_variable id="var_32bit_arufm_{{{ NAME }}}_head" version="1" datatype="string" comment="audit rule arch and syscal">
|
|
|
44eea6 |
- <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*({{{ NAME }}})(?:,[\S]+)*)[\s]+</value>
|
|
|
44eea6 |
+ <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,]))).*</value>
|
|
|
44eea6 |
</constant_variable>
|
|
|
44eea6 |
<constant_variable id="var_64bit_arufm_{{{ NAME }}}_head" version="1" datatype="string" comment="audit rule arch and syscal">
|
|
|
44eea6 |
- <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*({{{ NAME }}})(?:,[\S]+)*)[\s]+</value>
|
|
|
44eea6 |
+ <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{{ NAME }}}[\s]+|([\s]+|[,]){{{ NAME }}}([\s]+|[,]))).*</value>
|
|
|
44eea6 |
</constant_variable>
|
|
|
44eea6 |
<constant_variable id="var_arufm_{{{ NAME }}}_tail" version="1" datatype="string" comment="audit rule auid and key">
|
|
|
44eea6 |
<value>[\s]+(?:-F\s+auid>={{{ auid }}}[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
|