Re: ANOM_ROOT_TRANS

[Steve Grubb <sgrubb@redhat.com>]

On Tuesday, October 2, 2018 7:43:04 AM EDT Maupertuis Philippe wrote:
> According to the Redhat 7 security guide ANOM_ROOT_TRANS is triggered when
> a user becomes root. It seems that using sudo doesn't  trigger this event.
> I would like to know how this event is triggered.

Looking at the blame view of libaudit.h on github, this was imported as far 
back as 1.7.4 over 10 years ago. Back then, work was being done around 
prelude IDS and feeding it with events for correlation and escalation. That 
work was mothballed when prelude upstream became inactive. Prelude support 
has also been removed from audit-3.0 when it gets released.


> There are also several ANOM_ types that I can't see generated.
> Is there a document describing from where these event would come.

The event types in libaudit.h are not 100% supported. Some were supported and 
are now not in use. (Can't remove them since you really might run across the 
event in a heterogenous network.) Many in the ANOM and RESP categories are 
placeholders for future use. The description is accurate wrt the intended 
use. At the moment nothing I know of is sending that event. But the roadmap 
for audit 3.1 has a mention for a basic IDS capability. That might be when 
ANOM and RESP categories get better supported. I wouldn't expect sudo or su 
to send these.

-Steve