Ordered audit rules
Change-Id: Idb705cfab5cebb4568109f9b25a6087b9a667d1b
Closes-PROD: https://mirantis.jira.com/browse/PROD-21187
diff --git a/metadata/service/rules/ciscat.yml b/metadata/service/rules/ciscat.yml
index 2417e1c..fca89c3 100644
--- a/metadata/service/rules/ciscat.yml
+++ b/metadata/service/rules/ciscat.yml
@@ -25,90 +25,104 @@
enabled: 2
bufsize: 8192
rules:
- MAC_policy:
+ 100:
+ key: MAC_policy
enabled: true
rule_list:
- - '-w /etc/apparmor/ -p wa'
- - '-w /etc/apparmor.d/ -p wa'
- access:
+ - '-w /etc/apparmor/ -p wa'
+ - '-w /etc/apparmor.d/ -p wa'
+ 110:
+ key: access
enabled: true
rule_list:
- - '-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295'
- - '-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295'
- - '-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295'
- - '-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295'
- actions:
+ - '-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295'
+ 120:
+ key: actions
enabled: true
rule_list:
- - '-w /var/log/sudo.log -p wa'
- delete:
+ - '-w /var/log/sudo.log -p wa'
+ 130:
+ key: delete
enabled: true
rule_list:
- - '-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295'
- - '-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295'
- identity:
+ - '-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295'
+ 140:
+ key: identity
enabled: true
rule_list:
- - '-w /etc/group -p wa'
- - '-w /etc/passwd -p wa'
- - '-w /etc/gshadow -p wa'
- - '-w /etc/shadow -p wa'
- - '-w /etc/security/opasswd -p wa'
- logins:
+ - '-w /etc/group -p wa'
+ - '-w /etc/passwd -p wa'
+ - '-w /etc/gshadow -p wa'
+ - '-w /etc/shadow -p wa'
+ - '-w /etc/security/opasswd -p wa'
+ 150:
+ key: logins
enabled: true
rule_list:
- - '-w /var/log/faillog -p wa'
- - '-w /var/log/lastlog -p wa'
- - '-w /var/log/tallylog -p wa'
- modules:
+ - '-w /var/log/faillog -p wa'
+ - '-w /var/log/lastlog -p wa'
+ - '-w /var/log/tallylog -p wa'
+ 160:
+ key: modules
enabled: true
rule_list:
- - '-w /sbin/insmod -p x'
- - '-w /sbin/rmmod -p x'
- - '-w /sbin/modprobe -p x'
- - '-a always,exit -F arch=b64 -S init_module -S delete_module'
- mounts:
+ - '-w /sbin/insmod -p x'
+ - '-w /sbin/rmmod -p x'
+ - '-w /sbin/modprobe -p x'
+ - '-a always,exit -F arch=b64 -S init_module -S delete_module'
+ 170:
+ key: mounts
enabled: true
rule_list:
- - '-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295'
- - '-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295'
- perm_mod:
+ - '-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295'
+ 180:
+ key: perm_mod
enabled: true
rule_list:
- - '-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295'
- - '-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295'
- - '-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295'
- - '-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295'
- - '-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295'
- - '-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295'
- privileged:
+ - '-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295'
+ 190:
+ key: privileged
enabled: true
- scope:
+ 200:
+ key: scope
enabled: true
rule_list:
- - '-w /etc/sudoers -p wa'
- - '-w /etc/sudoers.d -p wa'
- session:
+ - '-w /etc/sudoers -p wa'
+ - '-w /etc/sudoers.d -p wa'
+ 210:
+ key: session
enabled: true
rule_list:
- - '-w /var/run/utmp -p wa'
- - '-w /var/log/wtmp -p wa'
- - '-w /var/log/btmp -p wa'
- system_locale:
+ - '-w /var/run/utmp -p wa'
+ - '-w /var/log/wtmp -p wa'
+ - '-w /var/log/btmp -p wa'
+ 220:
+ key: system_locale
enabled: true
rule_list:
- - '-a always,exit -F arch=b64 -S sethostname -S setdomainname'
- - '-a always,exit -F arch=b32 -S sethostname -S setdomainname'
- - '-w /etc/issue -p wa'
- - '-w /etc/issue.net -p wa'
- - '-w /etc/hosts -p wa'
- - '-w /etc/network -p wa'
- - '-w /etc/networks -p wa'
- time_change:
+ - '-a always,exit -F arch=b64 -S sethostname -S setdomainname'
+ - '-a always,exit -F arch=b32 -S sethostname -S setdomainname'
+ - '-w /etc/issue -p wa'
+ - '-w /etc/issue.net -p wa'
+ - '-w /etc/hosts -p wa'
+ - '-w /etc/network -p wa'
+ - '-w /etc/networks -p wa'
+ 230:
+ key: time_change
enabled: true
rule_list:
- - '-a always,exit -F arch=b64 -S adjtimex -S settimeofday'
- - '-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime'
- - '-a always,exit -F arch=b64 -S clock_settime'
- - '-a always,exit -F arch=b32 -S clock_settime'
- - '-w /etc/localtime -p wa'
+ - '-a always,exit -F arch=b64 -S adjtimex -S settimeofday'
+ - '-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime'
+ - '-a always,exit -F arch=b64 -S clock_settime'
+ - '-a always,exit -F arch=b32 -S clock_settime'
+ - '-w /etc/localtime -p wa'