Skip to content

Commit

Permalink
Add auid criteria to rule to meet OL08-00-030380
Browse files Browse the repository at this point in the history 
This STIG ID requires that audit_rules_kernel_module_loading_finit,
the rule that complies it, also check for -F auid>=1000 -F auid!=unset
in the audit rule containing finit_module syscall. This applies to ol8

Signed-off-by: Edgar Aguilar <edgar.aguilar@oracle.com>
  • Loading branch information
@Xeicker
Xeicker committed Mar 10, 2022
1 parent 9633258 commit c04d0fa
Show file tree
Hide file tree
Showing 3 changed files with 28 additions and 1 deletion.
4 changes: 4 additions & 0 deletions ..._rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/bash/shared.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,11 @@ for ARCH in "${RULE_ARCHS[@]}"
do
ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
OTHER_FILTERS=""
{{% if product == "ol8" %}}
AUID_FILTERS="-F auid>={{{ auid }}} -F auid!=unset"
{{% else %}}
AUID_FILTERS=""
{{% endif %}}
SYSCALL="finit_module"
KEY="modules"
SYSCALL_GROUPING="init_module finit_module"
Expand Down
16 changes: 16 additions & 0 deletions ...rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/oval/shared.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,11 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_32bit_ardm_finit_module_augenrules" version="1">
<ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
{{% if product == "ol8" %}}
<ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
{{% else %}}
<ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
{{% endif %}}
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

Expand All @@ -45,7 +49,11 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_64bit_ardm_finit_module_augenrules" version="1">
<ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
{{% if product == "ol8" %}}
<ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
{{% else %}}
<ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
{{% endif %}}
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

Expand All @@ -54,7 +62,11 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_32bit_ardm_finit_module_auditctl" version="1">
<ind:filepath>/etc/audit/audit.rules</ind:filepath>
{{% if product == "ol8" %}}
<ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
{{% else %}}
<ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
{{% endif %}}
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

Expand All @@ -63,7 +75,11 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_64bit_ardm_finit_module_auditctl" version="1">
<ind:filepath>/etc/audit/audit.rules</ind:filepath>
{{% if product == "ol8" %}}
<ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
{{% else %}}
<ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
{{% endif %}}
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

Expand Down
9 changes: 8 additions & 1 deletion ...figure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,19 @@ description: |-
to read audit rules during daemon startup (the default), add the following lines to a file
with suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt> to capture kernel module
loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system:
{{% if product == "ol8" %}}
<pre>-a always,exit -F arch=<i>ARCH</i> -S finit_module -F auid>=1000 -F auid!=unset -F key=modules</pre>
{{% else %}}
<pre>-a always,exit -F arch=<i>ARCH</i> -S finit_module -F key=modules</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt> utility to read audit
{{% endif %}} If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt> utility to read audit
rules during daemon startup, add the following lines to <tt>/etc/audit/audit.rules</tt> file
in order to capture kernel module loading and unloading events, setting ARCH to either b32 or
b64 as appropriate for your system:
{{% if product == "ol8" %}}
<pre>-a always,exit -F arch=<i>ARCH</i> -S finit_module -F auid>=1000 -F auid!=unset -F key=modules</pre>
{{% else %}}
<pre>-a always,exit -F arch=<i>ARCH</i> -S finit_module -F key=modules</pre>
{{% endif %}}
rationale: |-
The addition/removal of kernel modules can be used to alter the behavior of
Expand Down

0 comments on commit c04d0fa

Please sign in to comment.