Defining Audit Rules

The Audit system operates on a set of rules that define what is to be captured in the log files. There are three types of Audit rules that can be specified:

Control rules — allow the Audit system's behavior and some of its configuration to be modified.

File system rules — also known as file watches, allow the auditing of access to a particular file or a directory.

System call rules — allow logging of system calls that any specified program makes.

Audit rules can be specified on the command line with the auditctl utility (note that these rules are not persistent across reboots), or written in the /etc/audit/audit.rules file. The following two sections summarize both approaches to defining Audit rules.

7.5.1. Defining Audit Rules with the auditctl Utility Note

All commands, which interact with the Audit service and the Audit log files require root privileges.

Ensure you execute these commands as the root user.

The auditctl command allows you to control the basic functionality of the Audit system and to define rules that decide which Audit events are logged.

Defining Control Rules

The following are some of the control rules that allow you to modify the behavior of the Audit system:

-b

sets the maximum amount of existing Audit buffers in the kernel, for example:

~]# auditctl -b 8192

-f

sets the action that is performed when a critical error is detected, for example:

~]# auditctl -f 2

The above configuration triggers a kernel panic in case of a critical error.

-e

enables and disables the Audit system or locks its configuration, for example:

~]# auditctl -e 2

The above command locks the Audit configuration.

-r

sets the rate of generated messages per second, for example:

~]# auditctl -r 0

The above configuration sets no rate limit on generated messages.

-s

reports the status of the Audit system, for example:

~]# auditctl -s

AUDIT_STATUS: enabled=1 flag=2 pid=0 rate_limit=0 backlog_limit=8192 lost=259 backlog=0

-l

lists all currently loaded Audit rules, for example:

~]# auditctl -l

LIST_RULES: exit,always watch=/etc/localtime perm=wa key=time-change LIST_RULES: exit,always watch=/etc/group perm=wa key=identity

LIST_RULES: exit,always watch=/etc/passwd perm=wa key=identity LIST_RULES: exit,always watch=/etc/gshadow perm=wa key=identity

⋮

-D

deletes all currently loaded Audit rules, for example:

~]# auditctl -D No rules

Defining File System Rules

To define a file system rule, use the following syntax:

auditctl -w path_to_file -p permissions -k key_name where:

path_to_file is the file or directory that is audited.

permissions are the permissions that are logged:

r — read access to a file or a directory.

w — write access to a file or a directory.

x — execute access to a file or a directory.

a — change in the file's or directory's attribute.

key_name is an optional string that helps you identify which rule or a set of rules generated a particular log entry.

Example 7.1. File System Rules

To define a rule that logs all write access to, and every attribute change of, the /etc/passwd file, execute the following command:

~]# auditctl -w /etc/passwd -p wa -k passwd_changes Note that the string following the -k option is arbitrary.

To define a rule that logs all write access to, and every attribute change of, all the files in the /etc/selinux/ directory, execute the following command:

~]# auditctl -w /etc/selinux/ -p wa -k selinux_changes

To define a rule that logs the execution of the /sbin/insm od command, which inserts a module into the Linux kernel, execute the following command:

~]# auditctl -w /sbin/insmod -p x -k module_insertion

Defining System Call Rules

To define a system call rule, use the following syntax:

auditctl -a action,filter -S system_call -F field=value -k key_name where:

action and filter specify when a certain event is logged. action can be either always or never.

filter specifies which kernel rule-matching filter is applied to the event. The rule-matching filter can be one of the following: task, exit, user, and exclude. For more information about these filters, refer to the beginning of Section 7.1, “Audit System Architecture”.

system_call specifies the system call by its name. A list of all system calls can be found in the /usr/include/asm /unistd_64 .h file. Several system calls can be grouped into one rule, each specified after the -S option.

field=value specifies additional options that furthermore modify the rule to match events based on a specified architecture, group ID, process ID, and others. For a full listing of all available field types and their values, refer to the auditctl(8) man page.

key_name is an optional string that helps you identify which rule or a set of rules generated a particular log entry.

Example 7.2. System Call Rules

To define a rule that creates a log entry every time the adjtim ex or settim eofday system calls are used by a program, and the system uses the 64-bit architecture, execute the following command:

~]# auditctl -a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time_change

To define a rule that creates a log entry every time a file is deleted or renamed by a system user whose ID is 500 or larger (the -F auid!=4 294 967295 option is used to exclude users whose login UID is not set), execute the following command:

~]# auditctl -a always,exit -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete

It is also possible to define a file system rule using the system call rule syntax. The following command creates a rule for system calls that is analogous to the -w /etc/shadow -p wa file system rule:

~]# auditctl -a always,exit -F path=/etc/shadow -F perm=wa

7.5.2. Defining Persistent Audit Rules and Controls in the /etc/audit/audit.rules File

To define Audit rules that are persistent across reboots, you must include them in the

/etc/audit/audit.rules file. This file uses the same auditctl command line syntax to specify the rules. Any empty lines or any text following a hash sign (#) is ignored.

The auditctl command can also be used to read rules from a specified file with the -R option, for example:

~]# auditctl -R /usr/share/doc/audit-version/stig.rules

Defining Control Rules

A file can contain only the following control rules that modify the behavior of the Audit system: -b, -D, -e, -f, and -r. For more information on these options, refer to Section 7.5.1, “Defining Control Rules”.

Example 7.3. Control rules in audit.rules

# Delete all previous rules -D

# Set buffer size -b 8192

# Make the configuration immutable -- reboot is required to change audit rules -e 2

# Panic when a failure occurs -f 2

# Generate at most 100 audit messages per second -r 100

Defining File System and System Call Rules