Internal commands track in AuditD

Internal commands track in AuditD

[Muthamilan Sargunaanandan]

[-- Attachment #1.1: Type: text/plain, Size: 214 bytes --]

Hello SMEs,

I would like to add the Internal commands (example cd , |, > and etc) track
in AuditD.

Can I get the auditd rules to trace the user commands including the
internal commands.

Thanks in advance,
Muthu

[-- Attachment #1.2: Type: text/html, Size: 323 bytes --]

[-- Attachment #2: Type: text/plain, Size: 106 bytes --]

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: Internal commands track in AuditD

[Richard Guy Briggs]

On 2021-06-20 15:42, Muthamilan Sargunaanandan wrote:
> Hello SMEs,

Hi Muthu,

> I would like to add the Internal commands (example cd , |, > and etc) track
> in AuditD.

Thanks for your question.  This can be a real challenge.

> Can I get the auditd rules to trace the user commands including the
> internal commands.

Since these are built-in to many shells, the processes running the
shells themselves would need to be monitored.  Other filters monitoring
specific files or users would likely be more helpful.  There may be a
need to provide system-level (/etc/* defaults) to those shells to
restrict their functionality if they prove to be a liability.

> Thanks in advance,
> Muthu

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: Internal commands track in AuditD

[Steve Grubb]

On Sunday, June 20, 2021 4:42:48 PM EDT Muthamilan Sargunaanandan wrote:
> I would like to add the Internal commands (example cd , |, > and etc) track
> in AuditD.

Internal to what? Auditd just logs events to disk. The kernel is what decides 
what should be logged. The kernel's view is pretty much what you'd see in 
strace output. If there is something in the strace that is significant, a 
syscall rule can be written for it.

> Can I get the auditd rules to trace the user commands including the
> internal commands.

The kernel doesn't have visibility into the meaning of anything users do. But 
what it can do is record any keystrokes that a user may type regardless of 
what program is receiving the characters. You can look into pam_tty_audit if 
you want to do that. It will record these as TTY events that you can later 
post process 

-Steve


--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit