Auditd : Add Audit Rules2021/03/04 |
|
It's possible to add your own Audit rules like follows.
|
|
| [1] | For example, Configure Audit rule that records writing and attributes change for [/etc/hosts]. |
|
# display current rules (no rules by default like follows) [root@dlp ~]# auditctl -l No rules # -p [r|w|x|a] : specify target action for Audit # r=read, w=write, x=execute, a=attributes # -k [words] : set keys for searching logs [root@dlp ~]# auditctl -w /etc/hosts -p wa -k hosts_change [root@dlp ~]# auditctl -l -w /etc/hosts -p wa -k hosts_change |
| [2] | When some actions are set and it is detected by new Audit rules, Audit logs are recorded like follows. |
|
[root@dlp ~]# ausearch -k hosts_change | aureport -f -i File Report =============================================== # date time file syscall success exe auid event =============================================== 1. 03/04/2021 19:35:12 /etc/hosts~ rename yes /usr/bin/vi root 239 2. 03/04/2021 19:35:12 /etc/hosts openat yes /usr/bin/vi root 240 3. 03/04/2021 19:35:12 /etc/hosts setxattr yes /usr/bin/vi root 241 4. 03/04/2021 19:35:12 (null) fchmod yes /usr/bin/vi root 242 5. 03/04/2021 19:35:12 /etc/hosts setxattr yes /usr/bin/vi root 243 6. 03/04/2021 19:35:35 /etc/hosts openat yes /usr/bin/bash root 244 |
| [3] | Rules added by [auditctl] command are not kept after restarting System, so it needs to add them in a file under [/etc/audit/rules.d] if you'd like to keep persistently. It's OK to add rules to any file name you like under [/etc/audit/rules.d], but extension should be [.rules]. |
|
# output current rules to [additional.rules] [root@dlp ~]# auditctl -l >> /etc/audit/rules.d/additional.rules |
| [4] | If you set a directory for Audit Target, all files are targeted recursively under the directory. |
|
# set Audit rule (reading) to [/home/testdir/] [root@dlp ~]# auditctl -w /home/testdir/ -p r -k testdir_audit [root@dlp ~]# auditctl -l -w /etc/hosts -p wa -k hosts_change -w /home/testdir -p r -k testdir_audit # logs are recorded like follows [root@dlp ~]# ausearch -k testdir_audit | aureport -f -i File Report =============================================== # date time file syscall success exe auid event =============================================== 1. 03/04/2021 19:37:56 /home/testdir sendto yes /usr/sbin/auditctl root 107 2. 03/04/2021 19:38:42 /home/testdir/test.txt openat yes /usr/bin/cat root 110 3. 03/04/2021 19:39:30 /home/testdir/cent/.testfile.txt.swp openat yes /usr/bin/vi root 114 4. 03/04/2021 19:39:30 /home/testdir/cent/.testfile.txt.swx openat yes /usr/bin/vi root 115 5. 03/04/2021 19:39:30 /home/testdir/cent/.testfile.txt.swp openat yes /usr/bin/vi root 116 6. 03/04/2021 19:39:30 /home/testdir/cent/.testfile.txt.swp getxattr yes /usr/bin/vi root 117 7. 03/04/2021 19:39:30 /home/testdir/cent/.testfile.txt.swp getxattr yes /usr/bin/vi root 118 8. 03/04/2021 19:39:39 /home/testdir/cent/testfile.txt openat yes /usr/bin/cat root 119 |
| [5] | For example, Set Audit rule that monitors files removed by users who has over UID 1000. By the way, for the option by [S] below, you can make sure all System Calls with [man syscalls], maybe after installing [dnf install man-pages]. |
|
[root@dlp ~]#
auditctl -a always,exit -F arch=b64 -S unlink,unlinkat -F 'auid>=1000' -F 'auid!=-1' -F key=delete_audit [root@dlp ~]# auditctl -l -w /etc/hosts -p wa -k hosts_change -w /home/testdir -p r -k testdir_audit -a always,exit -F arch=b64 -S unlink,unlinkat -F auid>=1000 -F auid!=-1 -F key=delete_audit # logs are recorded like follows [root@dlp ~]# ausearch -k delete_audit | aureport -f -i File Report =============================================== # date time file syscall success exe auid event =============================================== 1. 03/04/2021 19:41:25 /run/user/1000/systemd/ unlink no /usr/lib/systemd/systemd cent 144 2. 03/04/2021 19:41:25 /run/user/1000/systemd/ unlink no /usr/lib/systemd/systemd cent 145 3. 03/04/2021 19:42:10 /home/testdir/cent/testfile.txt unlinkat yes /usr/bin/rm cent 189 |
| Sponsored Link |