-
Notifications
You must be signed in to change notification settings - Fork 718
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #10491 from marcusburghardt/cis_audit_kernel_modules
Update 4.1.3.19 CIS requirement for RHEL8 and RHEL9
- Loading branch information
Showing
16 changed files
with
226 additions
and
22 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
58 changes: 58 additions & 0 deletions
58
...es/audit_kernel_module_loading/audit_rules_kernel_module_loading_query/ansible/shared.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| # platform = multi_platform_all | ||
| # reboot = false | ||
| # complexity = low | ||
| # disruption = low | ||
| # strategy = configure | ||
|
|
||
| {{% set auid_filters = "-F auid>=" ~ auid ~ " -F auid!=unset" %}} | ||
|
|
||
| # What architecture are we on? | ||
|
|
||
| - name: Set architecture for audit query_module tasks | ||
| set_fact: | ||
| audit_arch: "b64" | ||
| when: | ||
| - ansible_architecture == "aarch64" or | ||
| ansible_architecture == "ppc64" or | ||
| ansible_architecture == "ppc64le" or | ||
| ansible_architecture == "s390x" or | ||
| ansible_architecture == "x86_64" | ||
|
|
||
| - name: Perform remediation of Audit rules for query_module for x86 platform | ||
| block: | ||
| {{{ ansible_audit_augenrules_add_syscall_rule( | ||
| action_arch_filters="-a always,exit -F arch=b32", | ||
| other_filters="", | ||
| auid_filters=auid_filters, | ||
| syscalls=["query_module"], | ||
| key="module-change", | ||
| syscall_grouping=["init_module","query_module"], | ||
| )|indent(4) }}} | ||
| {{{ ansible_audit_auditctl_add_syscall_rule( | ||
| action_arch_filters="-a always,exit -F arch=b32", | ||
| other_filters="", | ||
| auid_filters=auid_filters, | ||
| syscalls=["query_module"], | ||
| key="module-change", | ||
| syscall_grouping=["init_module","query_module"], | ||
| )|indent(4) }}} | ||
|
|
||
| - name: Perform remediation of Audit rules for query_module for x86_64 platform | ||
| block: | ||
| {{{ ansible_audit_augenrules_add_syscall_rule( | ||
| action_arch_filters="-a always,exit -F arch=b64", | ||
| other_filters="", | ||
| auid_filters=auid_filters, | ||
| syscalls=["query_module"], | ||
| key="module-change", | ||
| syscall_grouping=["init_module","query_module"], | ||
| )|indent(4) }}} | ||
| {{{ ansible_audit_auditctl_add_syscall_rule( | ||
| action_arch_filters="-a always,exit -F arch=b64", | ||
| other_filters="", | ||
| auid_filters=auid_filters, | ||
| syscalls=["query_module"], | ||
| key="module-change", | ||
| syscall_grouping=["init_module","query_module"], | ||
| )|indent(4) }}} | ||
| when: audit_arch == "b64" |
22 changes: 22 additions & 0 deletions
22
..._rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_query/bash/shared.sh
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| # platform = multi_platform_all | ||
|
|
||
| # First perform the remediation of the syscall rule | ||
| # Retrieve hardware architecture of the underlying system | ||
| # Note: 32-bit and 64-bit kernel syscall numbers not always line up => | ||
| # it's required on a 64-bit system to check also for the presence | ||
| # of 32-bit's equivalent of the corresponding rule. | ||
| # (See `man 7 audit.rules` for details ) | ||
| [ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64") | ||
|
|
||
| for ARCH in "${RULE_ARCHS[@]}" | ||
| do | ||
| ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH" | ||
| OTHER_FILTERS="" | ||
| AUID_FILTERS="-F auid>={{{ auid }}} -F auid!=unset" | ||
| SYSCALL="query_module" | ||
| KEY="modules" | ||
| SYSCALL_GROUPING="init_module query_module" | ||
| # Perform the remediation for both possible tools: 'auditctl' and 'augenrules' | ||
| {{{ bash_fix_audit_syscall_rule("augenrules", "$ACTION_ARCH_FILTERS", "$OTHER_FILTERS", "$AUID_FILTERS", "$SYSCALL", "$SYSCALL_GROUPING", "$KEY") }}} | ||
| {{{ bash_fix_audit_syscall_rule("auditctl", "$ACTION_ARCH_FILTERS", "$OTHER_FILTERS", "$AUID_FILTERS", "$SYSCALL", "$SYSCALL_GROUPING", "$KEY") }}} | ||
| done |
69 changes: 69 additions & 0 deletions
69
...rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_query/oval/shared.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| <def-group> | ||
| <definition class="compliance" id="{{{ rule_id }}}" version="1"> | ||
| {{{ oval_metadata("The audit rules should be configured to log information about kernel module loading and unloading.") }}} | ||
|
|
||
| <criteria operator="OR"> | ||
|
|
||
| <!-- Test the augenrules case --> | ||
| <criteria operator="AND"> | ||
| <extend_definition comment="audit augenrules" definition_ref="audit_rules_augenrules" /> | ||
| <criterion comment="audit augenrules 32-bit query_module" test_ref="test_32bit_ardm_query_module_augenrules" /> | ||
| <criteria operator="OR"> | ||
| <!-- System either isn't 64-bit => we just check presence of 32-bit version of query_module audit DAC rule --> | ||
| <extend_definition comment="64-bit system" definition_ref="system_info_architecture_64bit" negate="true" /> | ||
| <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of query_module audit DAC rule --> | ||
| <criterion comment="audit augenrules 64-bit query_module" test_ref="test_64bit_ardm_query_module_augenrules" /> | ||
| </criteria> | ||
| </criteria> | ||
|
|
||
| <!-- OR test the auditctl case --> | ||
| <criteria operator="AND"> | ||
| <extend_definition comment="audit auditctl" definition_ref="audit_rules_auditctl" /> | ||
| <criterion comment="audit auditctl 32-bit query_module" test_ref="test_32bit_ardm_query_module_auditctl" /> | ||
| <criteria operator="OR"> | ||
| <!-- System either isn't 64-bit => we just check presence of 32-bit version of the query_module audit DAC rule --> | ||
| <extend_definition comment="64-bit system" definition_ref="system_info_architecture_64bit" negate="true" /> | ||
| <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of query_module audit DAC rule --> | ||
| <criterion comment="audit auditctl 64-bit query_module" test_ref="test_64bit_ardm_query_module_auditctl" /> | ||
| </criteria> | ||
| </criteria> | ||
|
|
||
| </criteria> | ||
| </definition> | ||
|
|
||
| <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit query_module" id="test_32bit_ardm_query_module_augenrules" version="1"> | ||
| <ind:object object_ref="object_32bit_ardm_query_module_augenrules" /> | ||
| </ind:textfilecontent54_test> | ||
| <ind:textfilecontent54_object id="object_32bit_ardm_query_module_augenrules" version="1"> | ||
| <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath> | ||
| <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+query_module[\s]+|([\s]+|[,])query_module([\s]+|[,]))).*(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern> | ||
| <ind:instance datatype="int">1</ind:instance> | ||
| </ind:textfilecontent54_object> | ||
|
|
||
| <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit query_module" id="test_64bit_ardm_query_module_augenrules" version="1"> | ||
| <ind:object object_ref="object_64bit_ardm_query_module_augenrules" /> | ||
| </ind:textfilecontent54_test> | ||
| <ind:textfilecontent54_object id="object_64bit_ardm_query_module_augenrules" version="1"> | ||
| <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath> | ||
| <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+query_module[\s]+|([\s]+|[,])query_module([\s]+|[,]))).*(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern> | ||
| <ind:instance datatype="int">1</ind:instance> | ||
| </ind:textfilecontent54_object> | ||
|
|
||
| <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit query_module" id="test_32bit_ardm_query_module_auditctl" version="1"> | ||
| <ind:object object_ref="object_32bit_ardm_query_module_auditctl" /> | ||
| </ind:textfilecontent54_test> | ||
| <ind:textfilecontent54_object id="object_32bit_ardm_query_module_auditctl" version="1"> | ||
| <ind:filepath>/etc/audit/audit.rules</ind:filepath> | ||
| <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+query_module[\s]+|([\s]+|[,])query_module([\s]+|[,]))).*(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern> | ||
| <ind:instance datatype="int">1</ind:instance> | ||
| </ind:textfilecontent54_object> | ||
|
|
||
| <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit query_module" id="test_64bit_ardm_query_module_auditctl" version="1"> | ||
| <ind:object object_ref="object_64bit_ardm_query_module_auditctl" /> | ||
| </ind:textfilecontent54_test> | ||
| <ind:textfilecontent54_object id="object_64bit_ardm_query_module_auditctl" version="1"> | ||
| <ind:filepath>/etc/audit/audit.rules</ind:filepath> | ||
| <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+query_module[\s]+|([\s]+|[,])query_module([\s]+|[,]))).*(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern> | ||
| <ind:instance datatype="int">1</ind:instance> | ||
| </ind:textfilecontent54_object> | ||
| </def-group> |
39 changes: 39 additions & 0 deletions
39
...figure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_query/rule.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| documentation_complete: true | ||
|
|
||
| prodtype: rhel8,rhel9 | ||
|
|
||
| title: 'Ensure auditd Collects Information on Kernel Module Loading and Unloading - query_module' | ||
|
|
||
| description: |- | ||
| If the <tt>auditd</tt> daemon is configured to use the <tt>augenrules</tt> program | ||
| to read audit rules during daemon startup (the default), add the following lines to a file | ||
| with suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt> to capture kernel module | ||
| loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system: | ||
| <pre>-a always,exit -F arch=<i>ARCH</i> -S query_module -F auid>=1000 -F auid!=unset -F key=modules</pre> | ||
| If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt> utility to read audit | ||
| rules during daemon startup, add the following lines to <tt>/etc/audit/audit.rules</tt> file | ||
| in order to capture kernel module loading and unloading events, setting ARCH to either b32 or | ||
| b64 as appropriate for your system: | ||
| <pre>-a always,exit -F arch=<i>ARCH</i> -S query_module -F auid>=1000 -F auid!=unset -F key=modules</pre> | ||
| rationale: |- | ||
| The addition/removal of kernel modules can be used to alter the behavior of | ||
| the kernel and potentially introduce malicious code into kernel space. It is important | ||
| to have an audit trail of modules that have been introduced into the kernel. | ||
| severity: medium | ||
|
|
||
| identifiers: | ||
| cce@rhel8: CCE-88748-9 | ||
| cce@rhel9: CCE-88749-7 | ||
|
|
||
| references: | ||
| cis@rhel8: 4.1.3.19 | ||
| cis@rhel9: 4.1.3.19 | ||
|
|
||
| {{{ complete_ocil_entry_audit_syscall(syscall="query_module") }}} | ||
|
|
||
| fixtext: |- | ||
| {{{ fixtext_audit_rules("query_module", "module_chng") | indent(4) }}} | ||
| srg_requirement: '{{{ srg_requirement_audit_command("query_module") }}}' |
5 changes: 5 additions & 0 deletions
5
...kernel_module_loading/audit_rules_kernel_module_loading_query/tests/correct_rules.pass.sh
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| #!/bin/bash | ||
| # packages = audit | ||
|
|
||
| echo "-a always,exit -F arch=b32 -S query_module -F auid>=1000 -F auid!=unset -k modules" >> /etc/audit/rules.d/modules.rules | ||
| echo "-a always,exit -F arch=b64 -S query_module -F auid>=1000 -F auid!=unset -k modules" >> /etc/audit/rules.d/modules.rules |
8 changes: 8 additions & 0 deletions
8
..._module_loading/audit_rules_kernel_module_loading_query/tests/missing_auid_filter.fail.sh
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| #!/bin/bash | ||
| # platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 | ||
| # packages = audit | ||
|
|
||
| rm -f /etc/audit/rules.d/* | ||
|
|
||
| echo "-a always,exit -F arch=b32 -S query_module -k modules" >> /etc/audit/rules.d/modules.rules | ||
| echo "-a always,exit -F arch=b64 -S query_module -k modules" >> /etc/audit/rules.d/modules.rules |
6 changes: 6 additions & 0 deletions
6
...udit_kernel_module_loading/audit_rules_kernel_module_loading_query/tests/no_rules.fail.sh
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| #!/bin/bash | ||
| # remediation = bash | ||
| # packages = audit | ||
|
|
||
| rm -f /etc/audit/rules.d/* | ||
| > /etc/audit/audit.rules |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters