Re: EXT :Re: CD Burner Auditing

[Josh <jokajak@gmail.com>]

On Apr 22, 2014, at 6:11 PM, Steve Grubb <sgrubb@redhat.com> wrote:

> On Wednesday, April 23, 2014 08:00:47 AM Burn Alting wrote:
>> Steve,
>> 
>> The main challenge for this solution is the definition of all audit
>> events that imply removable media has been attached.
> 
> These are all hotplug events. Udev should see them all.
> 

While not exactly targeting the same data egress vector, we utilize a set of udev scripts to monitor USB device insertions while having the usb_storage module removed.

You can find more information https://github.com/RedHatGov/rhel6-hardening/pull/1

I haven’t done any investigation when a USB CD/DVD Writer is inserted though.  Nor have I investigated what events are triggered when a blank CD is inserted in to a CD writer.  Thought this might help.

-josh
> 
>> Juraj's example of monitoring for mount system calls covers the edge case of
>> copying to/from mounted devices (given you also identify removable devices
>> mounted as opposed to say network mounts), but it would not cover the
>> edge case of say dd'ing to a raw umounted device.
>> 
>> By the way, linking to
>> http://people.redhat.com/sgrubb/audit/reactive/reactive-audit-thesis.pdf
>> results in
> 
> Fixed. Thanks. 
> 
> -Steve
> 
> 
>> On Tue, 2014-04-22 at 16:39 -0400, Steve Grubb wrote:
>>> On Tuesday, April 22, 2014 04:06:05 PM Steve Grubb wrote:
>>>> On Tuesday, April 22, 2014 03:44:45 PM Boyce, Kevin P. wrote:
>>>>> Does the audit subsystem have the ability to dynamically create new
>>>>> auditing rules using another event as the trigger?
>>>> 
>>>> There was a patch for a reactive plugin sent to the list a number of
>>>> years
>>>> ago. The patch was too big and bounced, but I was cc'ed and have a copy.
>>>> I
>>>> have not had the time to review it to see if its maintainable,
>>>> supportable,
>>>> and exactly what I'd want. It's actually pretty well documented. I could
>>>> probably make it available off my people page since its too large for
>>>> the
>>>> mail list.
>>> 
>>> http://people.redhat.com/sgrubb/audit/reactive/
>>> 
>>> I have not reviewed the patch. I don't know if it still compiles or needs
>>> changes. I am very interested in the topic of being able to load more
>>> rules to watch something closer when certain things occur. If you look at
>>> the pdf, one of the use cases it assists in is auditing files on
>>> removable media.
>>> 
>>> I would like to hear feedback on this patch to see what others think.
>>> 
>>> -Steve
>>> 
>>> --
>>> Linux-audit mailing list
>>> Linux-audit@redhat.com
>>> https://www.redhat.com/mailman/listinfo/linux-audit
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit