From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Boyce, Kevin P [US] (AS)" Subject: Exclude Watched Items Date: Mon, 15 May 2017 21:08:33 +0000 Message-ID: <3a9b11a79cc643ebb56c841a38b29846@XCGVAG30.northgrum.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============7906605681483820779==" Return-path: Received: from mx1.redhat.com (ext-mx03.extmail.prod.ext.phx2.redhat.com [10.5.110.27]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 6266517B81 for ; Mon, 15 May 2017 21:11:55 +0000 (UTC) Received: from xspv0103.northgrum.com (xspv0103.northgrum.com [134.223.120.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id C106780F94 for ; Mon, 15 May 2017 21:11:53 +0000 (UTC) Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============7906605681483820779== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_3a9b11a79cc643ebb56c841a38b29846XCGVAG30northgrumcom_" --_000_3a9b11a79cc643ebb56c841a38b29846XCGVAG30northgrumcom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Ok I admit I should know how to do this, but it is evident I do not. On RHEL 5.11, what is the correct way for me to not audit anything in /proc= ? I had tried: -d entry,always -S all -F dir=3D/proc -a exclude,always -F dir=3D/proc Both of these are ignored. The first makes sense because I guess -d must m= atch exactly a rule already loaded in the kernel. The second is telling me I have an invalid message type, but I can't seem t= o find the valid message types documented in the man pages. Other systemcalls which are audited are open, fopen, chown, chattr, etc. I am trying to prevent auditing of the open syscall on /proc/... because th= ere are a lot of them, and it is not a requirement. Kevin --_000_3a9b11a79cc643ebb56c841a38b29846XCGVAG30northgrumcom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Ok I admit I should know how to do this, but it is e= vident I do not.

 

On RHEL 5.11, what is the correct way for me to not = audit anything in /proc?

 

I had tried:

-d entry,always –S all –F dir=3D/proc

-a exclude,always –F dir=3D/proc

 

Both of these are ignored.  The first makes sen= se because I guess –d must match exactly a rule already loaded in the= kernel.

The second is telling me I have an invalid message t= ype, but I can’t seem to find the valid message types documented in t= he man pages.

 

Other systemcalls which are audited are open, fopen,= chown, chattr, etc.

I am trying to prevent auditing of the open syscall = on /proc/… because there are a lot of them, and it is not a requireme= nt.

 

Kevin

--_000_3a9b11a79cc643ebb56c841a38b29846XCGVAG30northgrumcom_-- --===============7906605681483820779== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============7906605681483820779==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Richard Guy Briggs Subject: Re: Exclude Watched Items Date: Mon, 15 May 2017 23:22:38 -0400 Message-ID: <20170516032238.GP21241@madcap2.tricolour.ca> References: <3a9b11a79cc643ebb56c841a38b29846@XCGVAG30.northgrum.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <3a9b11a79cc643ebb56c841a38b29846@XCGVAG30.northgrum.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "Boyce, Kevin P [US] (AS)" Cc: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com On 2017-05-15 21:08, Boyce, Kevin P [US] (AS) wrote: > Ok I admit I should know how to do this, but it is evident I do not. > > On RHEL 5.11, what is the correct way for me to not audit anything in /proc? > > I had tried: > -d entry,always -S all -F dir=/proc > -a exclude,always -F dir=/proc > > Both of these are ignored. The first makes sense because I guess -d > must match exactly a rule already loaded in the kernel. "-d" says delete the rule. (I think the entry list is deprecated.) > The second is telling me I have an invalid message type, but I can't > seem to find the valid message types documented in the man pages. The exclude list only supports "-F msgtype=" on anything that old. More types are supported upstream and only very recent RHEL7. > Other systemcalls which are audited are open, fopen, chown, chattr, etc. > I am trying to prevent auditing of the open syscall on /proc/... > because there are a lot of them, and it is not a requirement. How about "-a exit,never -F dir=/proc"? > Kevin - RGB -- Richard Guy Briggs Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Boyce, Kevin P [US] (AS)" Subject: RE: EXT :Re: Exclude Watched Items Date: Tue, 16 May 2017 12:54:40 +0000 Message-ID: References: <3a9b11a79cc643ebb56c841a38b29846@XCGVAG30.northgrum.com> <20170516032238.GP21241@madcap2.tricolour.ca> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20170516032238.GP21241@madcap2.tricolour.ca> Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Richard Guy Briggs Cc: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com I'll give that a shot. How do I find out what the supported message types are? -----Original Message----- From: Richard Guy Briggs [mailto:rgb@redhat.com] Sent: Monday, May 15, 2017 11:23 PM To: Boyce, Kevin P [US] (AS) Cc: linux-audit@redhat.com Subject: EXT :Re: Exclude Watched Items On 2017-05-15 21:08, Boyce, Kevin P [US] (AS) wrote: > Ok I admit I should know how to do this, but it is evident I do not. > > On RHEL 5.11, what is the correct way for me to not audit anything in /proc? > > I had tried: > -d entry,always -S all -F dir=/proc > -a exclude,always -F dir=/proc > > Both of these are ignored. The first makes sense because I guess -d > must match exactly a rule already loaded in the kernel. "-d" says delete the rule. (I think the entry list is deprecated.) > The second is telling me I have an invalid message type, but I can't > seem to find the valid message types documented in the man pages. The exclude list only supports "-F msgtype=" on anything that old. More types are supported upstream and only very recent RHEL7. > Other systemcalls which are audited are open, fopen, chown, chattr, etc. > I am trying to prevent auditing of the open syscall on /proc/... > because there are a lot of them, and it is not a requirement. How about "-a exit,never -F dir=/proc"? > Kevin - RGB -- Richard Guy Briggs Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: EXT :Re: Exclude Watched Items Date: Tue, 16 May 2017 17:17:33 -0400 Message-ID: <31822977.FvFoqnaTAh@x2> References: <3a9b11a79cc643ebb56c841a38b29846@XCGVAG30.northgrum.com> <20170516032238.GP21241@madcap2.tricolour.ca> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Richard Guy Briggs List-Id: linux-audit@redhat.com On Tuesday, May 16, 2017 8:54:40 AM EDT Boyce, Kevin P [US] (AS) wrote: > I'll give that a shot. How do I find out what the supported message types > are? ausearch -m x This will cause ausearch to output an error message that describes the supported types. -Steve > -----Original Message----- > From: Richard Guy Briggs [mailto:rgb@redhat.com] > Sent: Monday, May 15, 2017 11:23 PM > To: Boyce, Kevin P [US] (AS) > Cc: linux-audit@redhat.com > Subject: EXT :Re: Exclude Watched Items > > On 2017-05-15 21:08, Boyce, Kevin P [US] (AS) wrote: > > Ok I admit I should know how to do this, but it is evident I do not. > > > > On RHEL 5.11, what is the correct way for me to not audit anything in > > /proc? > > > > I had tried: > > -d entry,always -S all -F dir=/proc > > -a exclude,always -F dir=/proc > > > > Both of these are ignored. The first makes sense because I guess -d > > must match exactly a rule already loaded in the kernel. > > "-d" says delete the rule. (I think the entry list is deprecated.) > > > The second is telling me I have an invalid message type, but I can't > > seem to find the valid message types documented in the man pages. > > The exclude list only supports "-F msgtype=" on anything that old. > > More types are supported upstream and only very recent RHEL7. > > > Other systemcalls which are audited are open, fopen, chown, chattr, etc. > > I am trying to prevent auditing of the open syscall on /proc/... > > because there are a lot of them, and it is not a requirement. > > How about "-a exit,never -F dir=/proc"? > > > Kevin > > - RGB > > -- > Richard Guy Briggs > Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, > Red Hat Canada IRC: rgb, SunRaycer > Voice: +1.647.777.2635, Internal: (81) 32635 > > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit