[Auditbeat] file_integrity - Monitor ACL and selinux attributes on Linux

[andrewkroh]

Describe the enhancement:

For the file_integrity module, add support for monitoring and reporting changes to the filesystem extended attributes (xattrs) named security.selinux and system.posix_acl_access. Events will contain the values of these xattrs. If the values change then an event should be reported. Both attributes' values contain a null-terminated string.

Describe a specific use case for the enhancement or feature:

In environments where SELinux is employed then it is useful to monitor file metadata for changes to SELinux labels. A change to labeling can impact security posture.

Similarly in environments where file ACLs are used (e.g. getfacl, setfacl) it is useful to monitor for changes to these ACLs (just like it is useful to monitor permissions in the file mode).

References

• https://www.man7.org/linux/man-pages/man7/xattr.7.html
• https://linux.die.net/man/2/getxattr
• https://wiki.gentoo.org/wiki/SELinux/Labels#Listing_file_labels

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

Apparently I was wrong about system.posix_acl_access being a string.

$setfacl -m u:landscape:rw /foo.bar

$ getfacl /foo.bar 
getfacl: Removing leading '/' from absolute path names
# file: foo.bar
# owner: root
# group: root
user::rw-
user:landscape:rw-
group::r--
mask::rw-
other::r--

$ getfattr -n system.posix_acl_access /foo.bar 
getfattr: Removing leading '/' from absolute path names
# file: foo.bar
system.posix_acl_access=0sAgAAAAEABgD/////AgAGAG8AAAAEAAQA/////xAABgD/////IAAEAP////8=

The ACL attribute values are in a canonical, architecture-independent binary format.

• https://linux.die.net/man/3/acl_to_text
• https://github.com/joshlf/go-acl/blob/eae00ae38531/acl.go#L123

[andrewkroh]

Confirming that the security.selinux label is a plain string.

$ sudo chcon -h system_u:object_r:bin_t:s0  /foo.bar 

$ ls -lZ /foo.bar 
-rw-rw-r--+ 1 root root system_u:object_r:bin_t:s0 0 Aug 14 16:49 /foo.bar

$ getfattr -n security.selinux /foo.bar 
# file: foo.bar
security.selinux="system_u:object_r:bin_t:s0"