From mboxrd@z Thu Jan  1 00:00:00 1970
From: John Jasen <jjasen@gmail.com>
Subject: Re: perhaps obvious question: auditd and setuid/setgid?
Date: Fri, 4 Sep 2015 13:36:40 -0400
Message-ID: <55E9D6A8.7010303@gmail.com>
References: <55E780DE.80400@gmail.com>
	<cf862b019d9d310f8c605a804d778428.squirrel@webmail.umbc.edu>
	<55E9B0B7.9040607@gmail.com> <2447871.tML4uAQppZ@x2>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (ext-mx08.extmail.prod.ext.phx2.redhat.com
	[10.5.110.32])
	by int-mx14.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP
	id t84Hahxc002730
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256
	verify=NO)
	for <linux-audit@redhat.com>; Fri, 4 Sep 2015 13:36:43 -0400
Received: from mail-io0-f169.google.com (mail-io0-f169.google.com
	[209.85.223.169])
	by mx1.redhat.com (Postfix) with ESMTPS id 7694FC0B2B44
	for <linux-audit@redhat.com>; Fri,  4 Sep 2015 17:36:42 +0000 (UTC)
Received: by iofh134 with SMTP id h134so31876115iof.0
	for <linux-audit@redhat.com>; Fri, 04 Sep 2015 10:36:41 -0700 (PDT)
Received: from [10.1.28.93] ([198.119.59.10])
	by smtp.googlemail.com with ESMTPSA id
	f3sm1910872igq.0.2015.09.04.10.36.40 for <linux-audit@redhat.com>
	(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
	Fri, 04 Sep 2015 10:36:41 -0700 (PDT)
In-Reply-To: <2447871.tML4uAQppZ@x2>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com



On 09/04/2015 12:20 PM, Steve Grubb wrote:
> On Friday, September 04, 2015 10:54:47 AM John Jasen wrote:
>> I was specifically wondering if I was missing the appropriate syscall
>> for the use of setuid or setgid.
>>
> >From a brief examination and test, this appears to not be the case?
>
> There are a couple ways to do this. One is using the find method. However, that 
> does not take into account file system based capabilities. In the lab I taught 
> this week, the rules generator also included this:

<snipped> filecap examples to add LINUX_CAP executables to audit.rules.

Huh .... I did not think of that.
> But, if all you want is setuid, then you can use a rule like this instead of 
> file watches:
>
> -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0

Perfect! Thanks.

For future generations googling for answers, I did the following:

-a always,exit -F arch=x86_64 -S execve -C uid!=euid -F key=execpriv
-a always,exit -F arch=x86_64 -S execve -C gid!=egid -F key=execpriv

I didn't pursue the last match, -F euid=0, as there may be cases where
you wish to audit setuid usage, but the binary is not setuid to root.