From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: SELinux for auditing Date: Thu, 1 Feb 2007 09:36:59 -0500 Message-ID: <200702010936.59578.sgrubb@redhat.com> References: <1170202290.4168.14.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1170202290.4168.14.camel@localhost.localdomain> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday 30 January 2007 19:11, Matthew Booth wrote: > I have a couple of requirements which on the face of it don't seem > simple to achieve with auditctl. These are: > > * Audit changes to executables > * Audit changes to configuration files > > I'll concentrate on the former as it's more obviously problematic. I > believe this would require putting a watch explicitly on every > executable in the system. Assuming current generation of audit code... auditctl -a exit,always -F perm=w -F obj_type=sbin_t -k executables auditctl -a exit,always -F perm=w -F obj_type=bin_t -k executables auditctl -a exit,always -F perm=w -F obj_type=lib_t -k executables auditctl -a exit,always -F perm=w -F obj_type=shlib_t -k executables > If this isn't correct, please correct me and this problem goes away. Try the above. "ausearch -k executables" would let you find these events. > This does 2 things. Firstly it enforces that the system won't execute > files which aren't labelled with an executable type. This might not be a bad thing to include even if the audit rules above solve your problem. > However, I'm worried I might be stepping outside design intentions. Is > the above a good idea? I'm hoping the audit system can meet any audit requirements. If not we need to work some more at it. > Is using SELinux for writing auditing rules a good idea in general? If there are shortcomings in the audit system that you can solve another way, I guess you have no choice. But we'd like to know that people cannot use the audit system for its intended purpose. -Steve