Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added provisional remediation to audit rules. #4107

Merged
merged 1 commit into from Mar 11, 2019
Merged

Added provisional remediation to audit rules. #4107

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
6 changes: 6 additions & 0 deletions ...ccessful_file_modification/audit_rules_unsuccessful_file_modification_creat/bash/rhel8.sh
View file
Open in desktop
@@ -0,0 +1,6 @@
# platform = multi_platform_rhel,multi_platorm_ol
#
# Include source function library.
. /usr/share/scap-security-guide/remediation_functions

create_audit_remediation_unsuccessful_file_modification_detailed /etc/audit/rules.d/30-ospp-v42-remediation.rules
6 changes: 6 additions & 0 deletions ...sful_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/bash/rhel8.sh
View file
Open in desktop
@@ -0,0 +1,6 @@
# platform = multi_platform_rhel,multi_platorm_ol
#
# Include source function library.
. /usr/share/scap-security-guide/remediation_functions

create_audit_remediation_unsuccessful_file_modification_detailed /etc/audit/rules.d/30-ospp-v42-remediation.rules
6 changes: 6 additions & 0 deletions ...uccessful_file_modification/audit_rules_unsuccessful_file_modification_open/bash/rhel8.sh
View file
Open in desktop
@@ -0,0 +1,6 @@
# platform = multi_platform_rhel,multi_platorm_ol
#
# Include source function library.
. /usr/share/scap-security-guide/remediation_functions

create_audit_remediation_unsuccessful_file_modification_detailed /etc/audit/rules.d/30-ospp-v42-remediation.rules
6 changes: 6 additions & 0 deletions ...e_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/bash/rhel8.sh
View file
Open in desktop
@@ -0,0 +1,6 @@
# platform = multi_platform_rhel,multi_platorm_ol
#
# Include source function library.
. /usr/share/scap-security-guide/remediation_functions

create_audit_remediation_unsuccessful_file_modification_detailed /etc/audit/rules.d/30-ospp-v42-remediation.rules
6 changes: 6 additions & 0 deletions ...cation/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat/bash/rhel8.sh
View file
Open in desktop
@@ -0,0 +1,6 @@
# platform = multi_platform_rhel,multi_platorm_ol
#
# Include source function library.
. /usr/share/scap-security-guide/remediation_functions

create_audit_remediation_unsuccessful_file_modification_detailed /etc/audit/rules.d/30-ospp-v42-remediation.rules
6 changes: 6 additions & 0 deletions .../audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write/bash/rhel8.sh
View file
Open in desktop
@@ -0,0 +1,6 @@
# platform = multi_platform_rhel,multi_platorm_ol
#
# Include source function library.
. /usr/share/scap-security-guide/remediation_functions

create_audit_remediation_unsuccessful_file_modification_detailed /etc/audit/rules.d/30-ospp-v42-remediation.rules
6 changes: 6 additions & 0 deletions ...ion/audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order/bash/rhel8.sh
View file
Open in desktop
@@ -0,0 +1,6 @@
# platform = multi_platform_rhel,multi_platorm_ol
#
# Include source function library.
. /usr/share/scap-security-guide/remediation_functions

create_audit_remediation_unsuccessful_file_modification_detailed /etc/audit/rules.d/30-ospp-v42-remediation.rules
6 changes: 6 additions & 0 deletions ...l_file_modification/audit_rules_unsuccessful_file_modification_open_o_creat/bash/rhel8.sh
View file
Open in desktop
@@ -0,0 +1,6 @@
# platform = multi_platform_rhel,multi_platorm_ol
#
# Include source function library.
. /usr/share/scap-security-guide/remediation_functions

create_audit_remediation_unsuccessful_file_modification_detailed /etc/audit/rules.d/30-ospp-v42-remediation.rules
6 changes: 6 additions & 0 deletions ..._modification/audit_rules_unsuccessful_file_modification_open_o_trunc_write/bash/rhel8.sh
View file
Open in desktop
@@ -0,0 +1,6 @@
# platform = multi_platform_rhel,multi_platorm_ol
#
# Include source function library.
. /usr/share/scap-security-guide/remediation_functions

create_audit_remediation_unsuccessful_file_modification_detailed /etc/audit/rules.d/30-ospp-v42-remediation.rules
6 changes: 6 additions & 0 deletions ...ile_modification/audit_rules_unsuccessful_file_modification_open_rule_order/bash/rhel8.sh
View file
Open in desktop
@@ -0,0 +1,6 @@
# platform = multi_platform_rhel,multi_platorm_ol
#
# Include source function library.
. /usr/share/scap-security-guide/remediation_functions

create_audit_remediation_unsuccessful_file_modification_detailed /etc/audit/rules.d/30-ospp-v42-remediation.rules
6 changes: 6 additions & 0 deletions ...cessful_file_modification/audit_rules_unsuccessful_file_modification_openat/bash/rhel8.sh
View file
Open in desktop
@@ -0,0 +1,6 @@
# platform = multi_platform_rhel,multi_platorm_ol
#
# Include source function library.
. /usr/share/scap-security-guide/remediation_functions

create_audit_remediation_unsuccessful_file_modification_detailed /etc/audit/rules.d/30-ospp-v42-remediation.rules
6 changes: 6 additions & 0 deletions ...file_modification/audit_rules_unsuccessful_file_modification_openat_o_creat/bash/rhel8.sh
View file
Open in desktop
@@ -0,0 +1,6 @@
# platform = multi_platform_rhel,multi_platorm_ol
#
# Include source function library.
. /usr/share/scap-security-guide/remediation_functions

create_audit_remediation_unsuccessful_file_modification_detailed /etc/audit/rules.d/30-ospp-v42-remediation.rules
6 changes: 6 additions & 0 deletions ...odification/audit_rules_unsuccessful_file_modification_openat_o_trunc_write/bash/rhel8.sh
View file
Open in desktop
@@ -0,0 +1,6 @@
# platform = multi_platform_rhel,multi_platorm_ol
#
# Include source function library.
. /usr/share/scap-security-guide/remediation_functions

create_audit_remediation_unsuccessful_file_modification_detailed /etc/audit/rules.d/30-ospp-v42-remediation.rules
6 changes: 6 additions & 0 deletions ...e_modification/audit_rules_unsuccessful_file_modification_openat_rule_order/bash/rhel8.sh
View file
Open in desktop
@@ -0,0 +1,6 @@
# platform = multi_platform_rhel,multi_platorm_ol
#
# Include source function library.
. /usr/share/scap-security-guide/remediation_functions

create_audit_remediation_unsuccessful_file_modification_detailed /etc/audit/rules.d/30-ospp-v42-remediation.rules
6 changes: 6 additions & 0 deletions ...ssful_file_modification/audit_rules_unsuccessful_file_modification_truncate/bash/rhel8.sh
View file
Open in desktop
@@ -0,0 +1,6 @@
# platform = multi_platform_rhel,multi_platorm_ol
#
# Include source function library.
. /usr/share/scap-security-guide/remediation_functions

create_audit_remediation_unsuccessful_file_modification_detailed /etc/audit/rules.d/30-ospp-v42-remediation.rules
46 changes: 46 additions & 0 deletions ...remediation_functions/create_audit_remediation_unsuccessful_file_modification_detailed.sh
View file
Open in desktop
@@ -0,0 +1,46 @@
function create_audit_remediation_unsuccessful_file_modification_detailed {
mkdir -p "$(dirname "$1")"
# The - option to mark a here document limit string (<<-EOF) suppresses leading tabs (but not spaces) in the output.
cat <<-EOF > "$1"
## This content is a section of an Audit config snapshot recommended for RHEL8 sytems that target OSPP compliance.
## The following content has been retreived on 2019-03-11 from: https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules

## The purpose of these rules is to meet the requirements for Operating
## System Protection Profile (OSPP)v4.2. These rules depends on having
## 10-base-config.rules, 11-loginuid.rules, and 43-module-load.rules installed.

## Unsuccessful file creation (open with O_CREAT)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create

## Unsuccessful file modifications (open for write or truncate)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification

## Unsuccessful file access (any other opens) This has to go last.
-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
EOF
}