path: root/framework/src/audit/contrib/capp.rules

##
## This file contains a sample audit configuration.  Combined with the
## system events that are audited by default, this set of rules causes
## audit to generate records for the auditable events specified by the
## Controlled Access Protection Profile (CAPP).
## 
## It should be noted that this set of rules identifies directories by 
## leaving a / at the end of the path.
##
## For audit 2.0.6 and higher
##

## Remove any existing rules
-D

## Increase buffer size to handle the increased number of messages.
## Feel free to increase this if the machine panic's
-b 8192

## Set failure mode to panic
-f 2

##
## FAU_SAR.1, FAU_SAR.2, FMT_MTD.1
## successful and unsuccessful attempts to read information from the
## audit records; all modifications to the audit trail
##
-w /var/log/audit/ -k LOG_audit

## 
## FAU_SEL.1, FMT_MTD.1
## modifications to audit configuration that occur while the audit
## collection functions are operating; all modications to the set of
## audited events
##
-w /etc/audit/ -p wa -k CFG_audit
-w /etc/sysconfig/auditd  -p wa -k CFG_auditd.conf
-w /etc/libaudit.conf -p wa -k CFG_libaudit.conf
-w /etc/audisp/ -p wa -k CFG_audisp

##
## FDP_ACF.1, FMT_MSA.1, FMT_MTD.1, FMT_REV.1
## all requests to perform an operation on an object covered by the
## SFP; all modifications of the values of security attributes;
## modifications to TSF data; attempts to revoke security attributes
##

## Objects covered by the Security Functional Policy (SFP) are:
## -File system objects (files, directories, special files, extended attributes)
## -IPC objects (SYSV shared memory, message queues, and semaphores)

## Operations on file system objects - by default, only monitor
## files and directories covered by filesystem watches.

## Changes in ownership and permissions
#-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat 
#-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat 
#-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown
#-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown
## Enable *32 rules if you are running on i386 or s390
## Do not use for x86_64, ia64, ppc, ppc64, or s390x
#-a always,exit -F arch=b32 -S fchown32,chown32,lchown32

## File content modification. Permissions are checked at open time,
## monitoring individual read/write calls is not useful.
#-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate,fallocate
#-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate,fallocate
## Enable *64 rules if you are running on i386, ppc, ppc64, s390
## Do not use for x86_64, ia64, or s390x
#-a always,exit -F arch=b32 -S truncate64,ftruncate64

## directory operations
#-a always,exit -F arch=b32 -S mkdir,mkdirat,rmdir
#-a always,exit -F arch=b64 -S mkdir,mkdirat,rmdir

## moving, removing, and linking
#-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat
#-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat
#-a always,exit -F arch=b32 -S link,linkat,symlink,symlinkat
#-a always,exit -F arch=b64 -S link,linkat,symlink,symlinkat

## Extended attribute operations
## Enable if you are interested in these events
#-a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr
#-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr

## special files
-a always,exit -F arch=b32 -S mknod,mknodat
-a always,exit -F arch=b64 -S mknod,mknodat

## Other file system operations
## Enable if i386
-a always,exit -F arch=b32 -S mount,umount,umount2
## Enable if ppc, s390, or s390x
#-a always,exit -F arch=b32 -S mount,umount,umount2
#-a always,exit -F arch=b64 -S mount,umount,umount2
## Enable if ia64
#-a always,exit -F arch=b64 -S mount,umount
## Enable if x86_64
#-a always,exit -F arch=b64 -S mount,umount2
#-a always,exit -F arch=b32 -S mount,umount,umount2

## IPC SYSV message queues
## Enable if you are interested in these events (x86,ppc,ppc64,s390,s390x)
## msgctl
#-a always,exit -S ipc -F a0=14
## msgget
#-a always,exit -S ipc -F a0=13
## Enable if you are interested in these events (x86_64,ia64)
#-a always,exit -S msgctl
#-a always,exit -S msgget

## IPC SYSV semaphores
## Enable if you are interested in these events (x86,ppc,ppc64,s390,s390x)
## semctl
#-a always,exit -S ipc -F a0=3
## semget
#-a always,exit -S ipc -F a0=2
## semop
#-a always,exit -S ipc -F a0=1
## semtimedop
#-a always,exit -S ipc -F a0=4
## Enable if you are interested in these events (x86_64, ia64)
#-a always,exit -S semctl
#-a always,exit -S semget
#-a always,exit -S semop
#-a always,exit -S semtimedop

## IPC SYSV shared memory
## Enable if you are interested in these events (x86,ppc,ppc64,s390,s390x)
## shmctl
#-a always,exit -S ipc -F a0=24
## shmget
#-a always,exit -S ipc -F a0=23
## Enable if you are interested in these events (x86_64, ia64)
#-a always,exit -S shmctl
#-a always,exit -S shmget

##
## FIA_USB.1
## success and failure of binding user security attributes to a subject
##
## Enable if you are interested in these events
##
#-a always,exit -F arch=b32 -S clone
#-a always,exit -F arch=b64 -S clone
#-a always,exit -F arch=b32 -S fork,vfork
#-a always,exit -F arch=b64 -S fork,vfork
## For ia64 architecture, disable fork and vfork rules above, and
## enable the following:
#-a always,exit -S clone2

##
## FMT_MSA.3
## modifications of the default setting of permissive or restrictive
## rules, all modifications of the initial value of security attributes
##
## Enable if you are interested in these events
##
#-a always,exit -F arch=b32 -S umask
#-a always,exit -F arch=b64 -S umask

##
## FPT_STM.1
## changes to the time
##
-a always,exit -F arch=b32 -S adjtimex,settimeofday -S stime
-a always,exit -F arch=b64 -S adjtimex,settimeofday
-a always,exit -F arch=b32 -S clock_settime -F a0=0
-a always,exit -F arch=b64 -S clock_settime -F a0=0
# Introduced in 2.6.39, commented out because it can make false positives
#-a always,exit -F arch=b32 -S clock_adjtime -F key=time-change
#-a always,exit -F arch=b64 -S clock_adjtime -F key=time-change

##
## FTP_ITC.1
## set-up of trusted channel
##
-w /usr/sbin/stunnel -p x

##
## Security Databases
##

## cron configuration & scheduled jobs
-w /etc/cron.allow -p wa -k CFG_cron.allow
-w /etc/cron.deny -p wa -k CFG_cron.deny
-w /etc/cron.d/ -p wa -k CFG_cron.d
-w /etc/cron.daily/ -p wa -k CFG_cron.daily
-w /etc/cron.hourly/ -p wa -k CFG_cron.hourly
-w /etc/cron.monthly/ -p wa -k CFG_cron.monthly
-w /etc/cron.weekly/ -p wa -k CFG_cron.weekly 
-w /etc/crontab -p wa -k CFG_crontab
-w /var/spool/cron/root -k CFG_crontab_root

## user, group, password databases
-w /etc/group -p wa -k CFG_group
-w /etc/passwd -p wa -k CFG_passwd
-w /etc/gshadow -k CFG_gshadow
-w /etc/shadow -k CFG_shadow
-w /etc/security/opasswd -k CFG_opasswd

## login configuration and information
-w /etc/login.defs -p wa -k CFG_login.defs
-w /etc/securetty -p wa -k CFG_securetty
-w /var/run/faillock/ -p wa -k LOG_faillock
-w /var/log/lastlog -p wa -k LOG_lastlog
-w /var/log/tallylog -p wa -k LOG_tallylog

## network configuration
-w /etc/hosts -p wa -k CFG_hosts
-w /etc/sysconfig/network-scripts/ -p wa -k CFG_network

## system startup scripts
-w /etc/sysconfig/init -p wa -k CFG_init
-w /etc/init/ -p wa -k CFG_init
-w /etc/inittab -p wa -k CFG_inittab
-w /etc/rc.d/init.d/ -p wa -k CFG_initscripts

## library search paths
-w /etc/ld.so.conf -p wa -k CFG_ld.so.conf

## local time zone
-w /etc/localtime -p wa -k CFG_localtime

## kernel parameters
-w /etc/sysctl.conf -p wa -k CFG_sysctl.conf

## modprobe configuration
-w /etc/modprobe.d/ -p wa -k CFG_modprobe

## pam configuration
-w /etc/pam.d/ -p wa -k CFG_pam
-w /etc/security/access.conf -p wa  -k CFG_pam
-w /etc/security/limits.conf -p wa  -k CFG_pam
-w /etc/security/pam_env.conf -p wa -k CFG_pam
-w /etc/security/namespace.conf -p wa -k CFG_pam
-w /etc/security/namespace.d/ -p wa -k CFG_pam
-w /etc/security/namespace.init -p wa -k CFG_pam
-w /etc/security/sepermit.conf -p wa -k CFG_pam
-w /etc/security/time.conf -p wa -k CFG_pam

## postfix configuration
-w /etc/aliases -p wa -k CFG_aliases
-w /etc/postfix/ -p wa -k CFG_postfix

## screen configuration
-w /etc/screenrc -p wa -k CFG_screen

## ssh configuration
-w /etc/ssh/sshd_config -k CFG_sshd_config

## stunnel configuration
-w /etc/stunnel/stunnel.conf -k CFG_stunnel.conf
-w /etc/stunnel/stunnel.pem -k CFG_stunnel.pem

## sudo configuration
-w /etc/sudoers -k CFG_sudoers
-w /etc/sudoers.d/ -k CFG_sudoers

## Not specifically required by CAPP; but common sense items
-a always,exit -F arch=b32 -S sethostname -S setdomainname
-a always,exit -F arch=b64 -S sethostname -S setdomainname
-w /etc/issue -p wa -k CFG_issue
-w /etc/issue.net -p wa -k CFG_issue.net

## Optional - could indicate someone trying to do something bad or
## just debugging
#-a always,exit -F arch=b32 -S ptrace -F key=tracing
#-a always,exit -F arch=b64 -S ptrace -F key=tracing
#-a always,exit -F arch=b32 -S ptrace -F a0=0x4 -F key=code-injection
#-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -F key=code-injection
#-a always,exit -F arch=b32 -S ptrace -F a0=0x5 -F key=data-injection
#-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -F key=data-injection
#-a always,exit -F arch=b32 -S ptrace -F a0=0x6 -F key=register-injection
#-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -F key=register-injection

## Optional - might want to watch module insertion
#-w /sbin/insmod -p x -k modules
#-w /sbin/rmmod -p x -k modules
#-w /sbin/modprobe -p x -k modules
#-a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load
#-a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load
#-a always,exit -F arch=b32 -S delete_module -F key=module-unload
#-a always,exit -F arch=b64 -S delete_module -F key=module-unload

## Optional - admin may be abusing power by looking in user's home dir
#-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=4294967295 -C auid!=obj_uid -F key=power-abuse

## Optional - log container creation
#-a always,exit -F arch=b32 -S clone -F a0&2080505856 -F key=container-create
#-a always,exit -F arch=b64 -S clone -F a0&2080505856 -F key=container-create

## Optional - watch for containers that may change their configuration
#-a always,exit -F arch=b32 -S unshare,setns -F key=container-config
#-a always,exit -F arch=b64 -S unshare,setns -F key=container-config

## Put your own watches after this point
# -w /your-file -p rwxa -k mykey

## Make the configuration immutable
#-e 2