LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 08-15-2006, 08:58 AM   #1
geburah
LQ Newbie
 
Registered: Mar 2006
Posts: 13

Rep: Reputation: 0
Question Set SELinux to audit everithing?


Hello,

I run RHEL 4 2.6.9-22.ELsmp

I want to run SElinux in permisive mode but I want to audit as much as possible, not only the failed logins.

I want to log when users rename a file or try to rename a fine, copies, deletions, etc. And include root user as well.

Thanks in advance.
 
Old 08-15-2006, 10:29 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
I want to log when users rename a file or try to rename a fine, copies, deletions, etc. And include root user as well.
Install LAuS ("audit" rpm AFAIK), check /etc/auditd.conf, add rules to /etc/audit.rules and run auditd.
 
Old 08-16-2006, 04:26 AM   #3
geburah
LQ Newbie
 
Registered: Mar 2006
Posts: 13

Original Poster
Rep: Reputation: 0
Very well, I have audit running, but the audit.rules file only contains this:


cat /etc/audit.rules
# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via the initscripts.

# First rule - delete all
-D

# Feel free to add below this line. See auditctl man page

# Increase the buffers to survive stress events
-b 256


I have been searching for a way to include rules but I don't find a single example of it. I don't find templates or example rules.

What's in you audit.rules file?

Thanks for your answer.
 
Old 08-16-2006, 06:17 AM   #4
geburah
LQ Newbie
 
Registered: Mar 2006
Posts: 13

Original Poster
Rep: Reputation: 0
well i found the capp.rules in the docuementation, which is a good start.

Thank you!
 
Old 08-16-2006, 10:50 AM   #5
geburah
LQ Newbie
 
Registered: Mar 2006
Posts: 13

Original Poster
Rep: Reputation: 0
Does anyone know a viewer or reader for the audit.log files?

or

can someone help me reading this:

type=SYSCALL
msg=audit(1155702961.442:7338):
arch=40000003
syscall=195
success=yes
exit=0
a0=8112ca
a1=bff92ffc
a2=b5dff4
a3=bff92ffc
ite
ms=1
pid=1998
auid=4294967295
uid=0
gid=0
euid=0
suid=0
fsuid=0
egid=0
sgid=0
fsgid=0
comm="crond"
exe="/usr/sbin/crond"


Thanks
 
Old 08-06-2008, 05:56 AM   #6
affekt
LQ Newbie
 
Registered: Aug 2008
Posts: 3

Rep: Reputation: 0
Quote:
Originally Posted by geburah View Post
type=SYSCALL
msg=audit(1155702961.442:7338):
arch=40000003
syscall=195
success=yes
exit=0
a0=8112ca
a1=bff92ffc
a2=b5dff4
a3=bff92ffc
ite
ms=1
pid=1998
auid=4294967295
uid=0
gid=0
euid=0
suid=0
fsuid=0
egid=0
sgid=0
fsgid=0
comm="crond"
exe="/usr/sbin/crond"
You logged SYSCALL, which caught uid 0 (root) executing syscall 195 (stat64) through crond in process id 1998.

Or in human readable form: your cron daemon checked some file information.
 
  


Reply

Tags
audit, rhel, selinux


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
/dev/audit bleunuit Linux - Software 0 05-11-2005 08:26 AM
security audit? nabil_boussetta Linux - Security 1 07-07-2004 03:38 AM
Printing Audit ezra143 Linux - General 0 07-06-2004 12:57 AM
Audit Pranesh Linux - Software 0 08-05-2003 09:13 AM
Audit Daemon in RH 7.3 oulevon Linux - Security 1 08-06-2002 07:20 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 10:07 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration