Skip to content

Commit 7fa1da0

Browse files
vojtapolasekvojtapolasek
authored
Merge pull request #13786 from teacup-on-rockingchair/audit_binaries_file_perm
Use platform specific audit binaries
2 parents 2abbc76 + e255cc0 commit 7fa1da0

32 files changed

Lines changed: 264 additions & 95 deletions

File tree

‎linux_os/guide/auditing/file_permissions_auditd/file_groupownership_audit_binaries/rule.yml‎

Lines changed: 9 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,10 @@ description: |-
88
ownership configured to protected against unauthorized access.
99
1010
Verify it by running the following command:
11-
<pre>$ stat -c "%n %G" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
12-
13-
/sbin/auditctl root
14-
/sbin/aureport root
15-
/sbin/ausearch root
16-
{{% if product not in ["rhel10"] %}}/sbin/autrace root{{% endif %}}
17-
/sbin/auditd root
18-
{{% if 'rhel' not in product %}}/sbin/audispd root{{% endif %}}
19-
/sbin/augenrules root
20-
{{%- if 'rhel' in product %}}
21-
/sbin/audisp-syslog root
22-
{{%- endif %}}
11+
<pre>$ stat -c "%n %G" {{{ audit_binaries | join(" ")}}}
12+
{{% for binary in audit_binaries %}}
13+
{{{ binary }}} root
14+
{{% endfor %}}
2315
</pre>
2416
2517
Audit tools needed to successfully view and manipulate audit information
@@ -48,16 +40,10 @@ references:
4840

4941
ocil: |-
5042
Verify it by running the following command:
51-
<pre>$ stat -c "%n %G" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules /sbin/audisp-syslog
52-
53-
/sbin/auditctl root
54-
/sbin/aureport root
55-
/sbin/ausearch root
56-
{{% if product not in ["rhel10"] %}}/sbin/autrace root{{% endif %}}
57-
/sbin/auditd root
58-
{{% if 'rhel' not in product %}}/sbin/audispd root{{% endif %}}
59-
/sbin/augenrules root
60-
{{% if 'rhel' in product %}}/sbin/audisp-syslog root{{% endif %}}
43+
<pre>$ stat -c "%n %G" {{{ audit_binaries | join(" ")}}}
44+
{{% for binary in audit_binaries %}}
45+
{{{ binary }}} root
46+
{{% endfor %}}
6147
</pre>
6248
6349
If the command does not return all the above lines, the missing ones
@@ -72,13 +58,5 @@ ocil: |-
7258
template:
7359
name: file_groupowner
7460
vars:
75-
filepath:
76-
- /sbin/auditctl
77-
- /sbin/aureport
78-
- /sbin/ausearch
79-
{{% if product not in ["rhel10"] %}}- /sbin/autrace{{% endif %}}
80-
- /sbin/auditd
81-
{{% if 'rhel' not in product and 'ubuntu' not in product %}}- /sbin/audispd{{% endif %}}
82-
- /sbin/augenrules
83-
{{% if 'rhel' in product %}}- /sbin/audisp-syslog{{% endif %}}
61+
filepath: {{{ audit_binaries }}}
8462
gid_or_name: '0'

‎linux_os/guide/auditing/file_permissions_auditd/file_ownership_audit_binaries/rule.yml‎

Lines changed: 9 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,10 @@ description: |-
88
ownership configured to protected against unauthorized access.
99
1010
Verify it by running the following command:
11-
<pre>$ stat -c "%n %U" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules /sbin/audisp-syslog
12-
13-
/sbin/auditctl root
14-
/sbin/aureport root
15-
/sbin/ausearch root
16-
{{% if product not in ["rhel10"] %}}/sbin/autrace root{{% endif %}}
17-
/sbin/auditd root
18-
{{% if 'rhel' not in product %}}/sbin/audispd root{{% endif %}}
19-
/sbin/augenrules root
20-
{{% if 'rhel' in product %}}/sbin/audisp-syslog root{{% endif %}}
11+
<pre>$ stat -c "%n %U" {{{ audit_binaries | join(" ")}}}
12+
{{% for binary in audit_binaries %}}
13+
{{{ binary }}} root
14+
{{% endfor %}}
2115
</pre>
2216
2317
Audit tools needed to successfully view and manipulate audit information
@@ -46,17 +40,11 @@ references:
4640

4741
ocil: |-
4842
Verify it by running the following command:
49-
<pre>$ stat -c "%n %U" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
50-
51-
/sbin/auditctl root
52-
/sbin/aureport root
53-
/sbin/ausearch root
54-
{{% if product not in ["rhel10"] %}}/sbin/autrace root{{% endif %}}
55-
/sbin/auditd root
56-
{{% if 'rhel' not in product %}}/sbin/audispd root{{% endif %}}
57-
/sbin/augenrules root
43+
<pre>$ stat -c "%n %U" {{{ audit_binaries | join(" ")}}}
44+
{{% for binary in audit_binaries %}}
45+
{{{ binary }}} root
46+
{{% endfor %}}
5847
</pre>
59-
6048
If the command does not return all the above lines, the missing ones
6149
need to be added.
6250
@@ -69,13 +57,5 @@ ocil: |-
6957
template:
7058
name: file_owner
7159
vars:
72-
filepath:
73-
- /sbin/auditctl
74-
- /sbin/aureport
75-
- /sbin/ausearch
76-
{{% if product not in ["rhel10"] %}}- /sbin/autrace{{% endif %}}
77-
- /sbin/auditd
78-
{{% if 'rhel' not in product %}}- /sbin/audispd{{% endif %}}
79-
- /sbin/augenrules
80-
{{% if 'rhel' in product %}}- /sbin/audisp-syslog{{% endif %}}
60+
filepath: {{{ audit_binaries }}}
8161
uid_or_name: '0'

‎linux_os/guide/auditing/file_permissions_auditd/file_permissions_audit_binaries/rule.yml‎

Lines changed: 9 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -8,22 +8,10 @@ description: |-
88
permissions configured to protected against unauthorized access.
99
1010
Verify it by running the following command:
11-
<pre>$ stat -c "%n %a" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
12-
13-
/sbin/auditctl 755
14-
/sbin/aureport 755
15-
/sbin/ausearch 755
16-
{{%- if product not in ["rhel10"] %}}
17-
/sbin/autrace 755
18-
{{%- endif %}}
19-
/sbin/auditd 755
20-
{{%- if 'rhel' not in product %}}
21-
/sbin/audispd 755
22-
{{%- endif %}}
23-
/sbin/augenrules 755
24-
{{%- if 'rhel' in product %}}
25-
/sbin/audisp-syslog 755
26-
{{%- endif %}}
11+
<pre>$ stat -c "%n %a" {{{ audit_binaries | join(" ")}}}
12+
{{% for binary in audit_binaries %}}
13+
{{{ binary }}} 755
14+
{{% endfor %}}
2715
</pre>
2816
2917
Audit tools needed to successfully view and manipulate audit information
@@ -52,17 +40,11 @@ references:
5240

5341
ocil: |-
5442
Verify it by running the following command:
55-
<pre>$ stat -c "%n %a" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules
56-
57-
/sbin/auditctl 755
58-
/sbin/aureport 755
59-
/sbin/ausearch 755
60-
{{% if product not in ["rhel10"] %}}/sbin/autrace 755{{% endif %}}
61-
/sbin/auditd 755
62-
{{% if 'rhel' not in product %}}/sbin/audispd 755{{% endif %}}
63-
/sbin/augenrules 755
43+
<pre>$ stat -c "%n %a" {{{ audit_binaries | join(" ")}}}
44+
{{% for binary in audit_binaries %}}
45+
{{{ binary }}} 755
46+
{{% endfor %}}
6447
</pre>
65-
6648
If the command does not return all the above lines, the missing ones
6749
need to be added.
6850
@@ -76,13 +58,5 @@ ocil: |-
7658
template:
7759
name: file_permissions
7860
vars:
79-
filepath:
80-
- /sbin/auditctl
81-
- /sbin/aureport
82-
- /sbin/ausearch
83-
{{% if product not in ["rhel10"] %}}- /sbin/autrace{{% endif %}}
84-
- /sbin/auditd
85-
{{% if 'rhel' not in product %}}- /sbin/audispd{{% endif %}}
86-
- /sbin/augenrules
87-
{{% if 'rhel' in product %}}- /sbin/audisp-syslog{{% endif %}}
61+
filepath: {{{ audit_binaries }}}
8862
filemode: '0755'

‎product_properties/10-audit-binaries.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
default:
2+
audit_binaries:
3+
- /sbin/auditctl
4+
- /sbin/aureport
5+
- /sbin/ausearch
6+
{{% if product not in ["rhel10"] %}}
7+
- /sbin/autrace
8+
{{% endif %}}
9+
- /sbin/auditd
10+
{{% if 'rhel' not in product and 'ubuntu' not in product and 'ol' not in product %}}
11+
- /sbin/audispd
12+
{{% endif %}}
13+
- /sbin/augenrules
14+
{{% if 'rhel' in product %}}
15+
- /sbin/audisp-syslog
16+
{{% endif %}}
17+
overrides:
18+
{{% if product == 'sle15' %}}
19+
audit_binaries:
20+
- /usr/sbin/auditctl
21+
- /usr/sbin/aureport
22+
- /usr/sbin/ausearch
23+
- /usr/sbin/autrace
24+
- /usr/sbin/auditd
25+
- /usr/sbin/augenrules
26+
- /usr/sbin/audisp-syslog
27+
{{% endif %}}

‎tests/data/product_stability/alinux2.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,14 @@ aide_also_checks_rsyslog: 'no'
33
aide_bin_path: /usr/sbin/aide
44
aide_conf_path: /etc/aide.conf
55
audisp_conf_path: /etc/audit
6+
audit_binaries:
7+
- /sbin/auditctl
8+
- /sbin/aureport
9+
- /sbin/ausearch
10+
- /sbin/autrace
11+
- /sbin/auditd
12+
- /sbin/audispd
13+
- /sbin/augenrules
614
audit_watches_style: legacy
715
auid: 1000
816
basic_properties_derived: true

‎tests/data/product_stability/alinux3.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,14 @@ aide_also_checks_rsyslog: 'no'
33
aide_bin_path: /usr/sbin/aide
44
aide_conf_path: /etc/aide.conf
55
audisp_conf_path: /etc/audit
6+
audit_binaries:
7+
- /sbin/auditctl
8+
- /sbin/aureport
9+
- /sbin/ausearch
10+
- /sbin/autrace
11+
- /sbin/auditd
12+
- /sbin/audispd
13+
- /sbin/augenrules
614
audit_watches_style: legacy
715
auid: 1000
816
basic_properties_derived: true

‎tests/data/product_stability/anolis23.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,13 @@ aide_also_checks_rsyslog: 'no'
33
aide_bin_path: /usr/sbin/aide
44
aide_conf_path: /etc/aide.conf
55
audisp_conf_path: /etc/audit
6+
audit_binaries:
7+
- /sbin/auditctl
8+
- /sbin/aureport
9+
- /sbin/ausearch
10+
- /sbin/autrace
11+
- /sbin/auditd
12+
- /sbin/augenrules
613
audit_watches_style: legacy
714
auid: 1000
815
basic_properties_derived: true

‎tests/data/product_stability/anolis8.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,13 @@ aide_also_checks_rsyslog: 'no'
33
aide_bin_path: /usr/sbin/aide
44
aide_conf_path: /etc/aide.conf
55
audisp_conf_path: /etc/audit
6+
audit_binaries:
7+
- /sbin/auditctl
8+
- /sbin/aureport
9+
- /sbin/ausearch
10+
- /sbin/autrace
11+
- /sbin/auditd
12+
- /sbin/augenrules
613
audit_watches_style: legacy
714
auid: 1000
815
basic_properties_derived: true

‎tests/data/product_stability/chromium.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,14 @@ aide_also_checks_rsyslog: 'no'
33
aide_bin_path: /usr/sbin/aide
44
aide_conf_path: /etc/aide.conf
55
audisp_conf_path: /etc/audit
6+
audit_binaries:
7+
- /sbin/auditctl
8+
- /sbin/aureport
9+
- /sbin/ausearch
10+
- /sbin/autrace
11+
- /sbin/auditd
12+
- /sbin/audispd
13+
- /sbin/augenrules
614
audit_watches_style: legacy
715
auid: 1000
816
basic_properties_derived: true

‎tests/data/product_stability/debian11.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,14 @@ aide_also_checks_rsyslog: 'no'
33
aide_bin_path: /usr/sbin/aide
44
aide_conf_path: /etc/aide.conf
55
audisp_conf_path: /etc/audit
6+
audit_binaries:
7+
- /sbin/auditctl
8+
- /sbin/aureport
9+
- /sbin/ausearch
10+
- /sbin/autrace
11+
- /sbin/auditd
12+
- /sbin/audispd
13+
- /sbin/augenrules
614
audit_watches_style: legacy
715
auid: 1000
816
basic_properties_derived: true

0 commit comments

Comments
 (0)