From mboxrd@z Thu Jan 1 00:00:00 1970 From: Josh Subject: Re: EXT :Re: CD Burner Auditing Date: Tue, 22 Apr 2014 20:13:13 -0400 Message-ID: <557A2828-5704-4FCA-9795-2D528B04C635@gmail.com> References: <5356BF94.6050901@ngc.com> <2296031.pChOuKX4da@x2> <1398204047.30383.17.camel@swtf.swtf.dyndns.org> <1441709.Q1RVjfmyXu@x2> Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\)) Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: quoted-printable Return-path: Received: from mx1.redhat.com (ext-mx14.extmail.prod.ext.phx2.redhat.com [10.5.110.19]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id s3N0DNm6024089 for ; Tue, 22 Apr 2014 20:13:23 -0400 Received: from mail-yk0-f179.google.com (mail-yk0-f179.google.com [209.85.160.179]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s3N0DLod025361 for ; Tue, 22 Apr 2014 20:13:21 -0400 Received: by mail-yk0-f179.google.com with SMTP id 9so198078ykp.38 for ; Tue, 22 Apr 2014 17:13:21 -0700 (PDT) Received: from joshks-air.int.kayses.us (c-67-191-185-71.hsd1.ga.comcast.net. [67.191.185.71]) by mx.google.com with ESMTPSA id z69sm81669886yha.26.2014.04.22.17.13.19 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 22 Apr 2014 17:13:19 -0700 (PDT) In-Reply-To: <1441709.Q1RVjfmyXu@x2> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Apr 22, 2014, at 6:11 PM, Steve Grubb wrote: > On Wednesday, April 23, 2014 08:00:47 AM Burn Alting wrote: >> Steve, >> = >> The main challenge for this solution is the definition of all audit >> events that imply removable media has been attached. > = > These are all hotplug events. Udev should see them all. > = While not exactly targeting the same data egress vector, we utilize a set o= f udev scripts to monitor USB device insertions while having the usb_storag= e module removed. You can find more information https://github.com/RedHatGov/rhel6-hardening/= pull/1 I haven=92t done any investigation when a USB CD/DVD Writer is inserted tho= ugh. Nor have I investigated what events are triggered when a blank CD is = inserted in to a CD writer. Thought this might help. -josh > = >> Juraj's example of monitoring for mount system calls covers the edge cas= e of >> copying to/from mounted devices (given you also identify removable devic= es >> mounted as opposed to say network mounts), but it would not cover the >> edge case of say dd'ing to a raw umounted device. >> = >> By the way, linking to >> http://people.redhat.com/sgrubb/audit/reactive/reactive-audit-thesis.pdf >> results in > = > Fixed. Thanks. = > = > -Steve > = > = >> On Tue, 2014-04-22 at 16:39 -0400, Steve Grubb wrote: >>> On Tuesday, April 22, 2014 04:06:05 PM Steve Grubb wrote: >>>> On Tuesday, April 22, 2014 03:44:45 PM Boyce, Kevin P. wrote: >>>>> Does the audit subsystem have the ability to dynamically create new >>>>> auditing rules using another event as the trigger? >>>> = >>>> There was a patch for a reactive plugin sent to the list a number of >>>> years >>>> ago. The patch was too big and bounced, but I was cc'ed and have a cop= y. >>>> I >>>> have not had the time to review it to see if its maintainable, >>>> supportable, >>>> and exactly what I'd want. It's actually pretty well documented. I cou= ld >>>> probably make it available off my people page since its too large for >>>> the >>>> mail list. >>> = >>> http://people.redhat.com/sgrubb/audit/reactive/ >>> = >>> I have not reviewed the patch. I don't know if it still compiles or nee= ds >>> changes. I am very interested in the topic of being able to load more >>> rules to watch something closer when certain things occur. If you look = at >>> the pdf, one of the use cases it assists in is auditing files on >>> removable media. >>> = >>> I would like to hear feedback on this patch to see what others think. >>> = >>> -Steve >>> = >>> -- >>> Linux-audit mailing list >>> Linux-audit@redhat.com >>> https://www.redhat.com/mailman/listinfo/linux-audit > = > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit