Create auditd formula
According to linked prod's we need to create fully functional
auditd formula. This formula allows install and configure auditd, as
well as generate auditd rules and install/configure audisp
plugins if necessary.
Change-Id: Ieb6c889c7fceec7281e1ad019b1f07daf689c3f7
Related-PROD: https://mirantis.jira.com/browse/PROD-20233
Related-PROD: https://mirantis.jira.com/browse/PROD-20138
diff --git a/metadata/service/rules/ciscat.yml b/metadata/service/rules/ciscat.yml
new file mode 100644
index 0000000..8482c09
--- /dev/null
+++ b/metadata/service/rules/ciscat.yml
@@ -0,0 +1,115 @@
+applications:
+- auditd
+classes:
+- service.auditd.support
+parameters:
+ auditd:
+ rules:
+ options:
+ enabled: 1
+ bufsize: 8192
+ rules:
+ MAC_policy:
+ enabled: true
+ rule_list:
+ - '-w /etc/apparmor/ -p wa'
+ - '-w /etc/apparmor.d/ -p wa'
+ access:
+ enabled: true
+ rule_list:
+ - '-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295'
+ actions:
+ enabled: true
+ rule_list:
+ - '-w /var/log/sudo.log -p wa'
+ delete:
+ enabled: true
+ rule_list:
+ - '-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295'
+ identity:
+ enabled: true
+ rule_list:
+ - '-w /etc/group -p wa'
+ - '-w /etc/passwd -p wa'
+ - '-w /etc/gshadow -p wa'
+ - '-w /etc/shadow -p wa'
+ - '-w /etc/security/opasswd -p wa'
+ logins:
+ enabled: true
+ rule_list:
+ - '-w /var/log/faillog -p wa'
+ - '-w /var/log/lastlog -p wa'
+ - '-w /var/log/tallylog -p wa'
+ modules:
+ enabled: true
+ rule_list:
+ - '-w /sbin/insmod -p x'
+ - '-w /sbin/rmmod -p x'
+ - '-w /sbin/modprobe -p x'
+ - '-a always,exit -F arch=b64 -S init_module -S delete_module'
+ mounts:
+ enabled: true
+ rule_list:
+ - '-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295'
+ perm_mod:
+ enabled: true
+ rule_list:
+ - '-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295'
+ privileged:
+ enabled: true
+ rule_list:
+ - '-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=4294967295'
+ - '-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=4294967295'
+ scope:
+ enabled: true
+ rule_list:
+ - '-w /etc/sudoers -p wa'
+ - '-w /etc/sudoers.d -p wa'
+ session:
+ enabled: true
+ rule_list:
+ - '-w /var/run/utmp -p wa'
+ - '-w /var/log/wtmp -p wa'
+ - '-w /var/log/btmp -p wa'
+ system_locale:
+ enabled: true
+ rule_list:
+ - '-a always,exit -F arch=b64 -S sethostname -S setdomainname'
+ - '-a always,exit -F arch=b32 -S sethostname -S setdomainname'
+ - '-w /etc/issue -p wa'
+ - '-w /etc/issue.net -p wa'
+ - '-w /etc/hosts -p wa'
+ - '-w /etc/network -p wa'
+ - '-w /etc/networks -p wa'
+ time_change:
+ enabled: true
+ rule_list:
+ - '-a always,exit -F arch=b64 -S adjtimex -S settimeofday'
+ - '-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime'
+ - '-a always,exit -F arch=b64 -S clock_settime'
+ - '-a always,exit -F arch=b32 -S clock_settime'
+ - '-w /etc/localtime -p wa'