1

We have configured auditd to log all access to certain critical files. The system runs WebLogic Server and we want to know if anyone is trying to poke around sensitive system files, such as the domain configuration file, encryption salt, et cetera. In some cases on some systems in the past, this worked as expected, but recently it has not, and I am at my wits' end trying to figure out why. So I am going against my nature and seeking outside assistance with this issue.

Relevant data points and possible leads I have been investigating:

  • We recently picked up an updated system image with a new kernel version.
  • The system image is OEL5 (essentialy RHEL5/CentOS 5)
  • When I reboot the system, it only loads a minimal ruleset:
    # auditctl -l
    LIST_RULES: exit,always dir=/etc/audit (0xa) perm=wa key=auditsys
    LIST_RULES: exit,always dir=/var/log/audit (0xe) perm=wa key=auditsys

Despite the full rules file still being in place.

When I try to restart the audit daemon (service auditd restart), I get the following error message:

Error sending add rule data request (No such file or directory)
There was an error in line 30 of /etc/audit/audit.rules

which turns out to be because one of the files we have told it to watch does not exist yet. I resolve this by creating the file manually, and repeat for every subsequent error. It seems to me therefore that one cannot have the audit daemon watch a path pre-emptively and report initial creation of a given file.

Can anyone suggest a workaround or alternative solution to this issue?

1

Two thoughts here:

1) Consider using a -i in your rules file.

"Ignore errors when reading rules from a file. This causes auditctl to always return a success exit code."

This keeps parsing on errors and picks up other rules. Otherwise, you end up with only the rules before the error. Obviously there is downside here, but sometimes it's better to have the correct rules in place regardless.

2) A simple hack to address directories/files that are not around at startup is to restart/reload auditd once the system reaches it's running state.

| improve this answer | |
  • "Consider using a -i in your rules file." -- where? I can't find this flag in man auditd or man audit.rules or examples on the WWW. please advise EDIT: I figured it out. See man auditctl – JDS Nov 23 '15 at 17:38
0

Passed in from the audit mailing list ...

> On Mon, 2015-05-11 at 15:52 -0400, Steve Grubb wrote:
> > On Monday, May 11, 2015 11:50:19 AM Bill Jackson III wrote:
> > > Any pointers for troubleshooting  auditd missing events for file reads,
> > > edits, etc. ( -w _path_ -p raw) on OEL5/RHEL 5/CentOS 5?
> > > 
> > > http://security.stackexchange.com/q/89009/56827
> > 
> > The -w notation is the same as
> > 
> > -a always,exit -F path=XXX -F perms=rwa
> > 
> > What this does is audit the following functions defined in the syscall 
> > classifiers
> > :
> > http://lxr.free-electrons.com/source/include/asm-generic/audit_read.h
> > http://lxr.free-electrons.com/source/include/asm-generic/audit_write.h
> > http://lxr.free-electrons.com/source/include/asm-generic/audit_change_attr.h
> > 
> > You are not going to get a hit for each and every read system call because 
> > read is not audited.
> 
> Bill,
> 
> Is your question
> 
>   "Can one apply a file watch using auditd if the file does not exist?"
> 
> then I believe the answer is no. 

There is a patch set coming to be able to address this case if the
directory exists.  Down the road, I'm hoping to be able to accomodate
non-existant directories too.

> Options would be 
> - as part of your application deployment standard operating procedures
> (SOPs) add appropriate watches to audit.rules and restart the auditd
> service
> - keep all you sensitive files in one directory location, set a
> directory watch on this directory tree and then as part of your
> application deployment SOPs, place the real files in the sensitive file
> area and then link to them from the application area. (I've just tried
> this on a fc22 system and it works)
> 
> Regards

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
| improve this answer | |
  • Regarding the patch set Richard mentioned in this message, it appears that Richard submitted patches to be able to handle non-existent files in "exe" rules, but never submitted patches to be able to handle non-existent files in "watch" rules: redhat.com/archives/linux-audit/2015-July/msg00018.html – Paul Donohue Jun 13 '17 at 18:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.