Gitiles
Code Review Sign In
gerrit.mcp.mirantis.com / salt-formulas / auditd / 6fbb5c08ca192c8e8b528d2ef143f09f9ea458e5 / . / metadata / service / rules / ciscat.yml
blob: 2417e1ce4bfa5fa55fd3bab97612b608d1f2ea0a [file] [log] [blame]
Ivan Suzdal50a360f2018-06-04 16:07:41 +0400[diff] [blame]1applications:
2- auditd
3classes:
4- service.auditd.support
5parameters:
6 auditd:
7 rules:
Ivan Suzdal9f9fbf42018-07-11 18:27:25 +0400[diff] [blame]8 filter_fs:
9 - binfmt_misc
10 - cgroup
11 - debugfs
12 - devpts
13 - devtmpfs
14 - fusectl
15 - hugetlbfs
16 - mqueue
17 - nsfs
18 - proc
19 - pstore
20 - securityfs
21 - sysfs
22 filter_paths:
23 - /var/lib/docker
Ivan Suzdal50a360f2018-06-04 16:07:41 +0400[diff] [blame]24 options:
Ivan Suzdal91e02452018-06-20 12:33:16 +0400[diff] [blame]25 enabled: 2
Ivan Suzdal50a360f2018-06-04 16:07:41 +0400[diff] [blame]26 bufsize: 8192
27 rules:
28 MAC_policy:
29 enabled: true
30 rule_list:
31 - '-w /etc/apparmor/ -p wa'
32 - '-w /etc/apparmor.d/ -p wa'
33 access:
34 enabled: true
35 rule_list:
36 - '-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295'
37 - '-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295'
38 - '-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295'
39 - '-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295'
40 actions:
41 enabled: true
42 rule_list:
43 - '-w /var/log/sudo.log -p wa'
44 delete:
45 enabled: true
46 rule_list:
47 - '-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295'
48 - '-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295'
49 identity:
50 enabled: true
51 rule_list:
52 - '-w /etc/group -p wa'
53 - '-w /etc/passwd -p wa'
54 - '-w /etc/gshadow -p wa'
55 - '-w /etc/shadow -p wa'
56 - '-w /etc/security/opasswd -p wa'
57 logins:
58 enabled: true
59 rule_list:
60 - '-w /var/log/faillog -p wa'
61 - '-w /var/log/lastlog -p wa'
62 - '-w /var/log/tallylog -p wa'
63 modules:
64 enabled: true
65 rule_list:
66 - '-w /sbin/insmod -p x'
67 - '-w /sbin/rmmod -p x'
68 - '-w /sbin/modprobe -p x'
69 - '-a always,exit -F arch=b64 -S init_module -S delete_module'
70 mounts:
71 enabled: true
72 rule_list:
73 - '-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295'
74 - '-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295'
75 perm_mod:
76 enabled: true
77 rule_list:
78 - '-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295'
79 - '-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295'
80 - '-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295'
81 - '-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295'
82 - '-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295'
83 - '-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295'
84 privileged:
85 enabled: true
Ivan Suzdal50a360f2018-06-04 16:07:41 +0400[diff] [blame]86 scope:
87 enabled: true
88 rule_list:
89 - '-w /etc/sudoers -p wa'
90 - '-w /etc/sudoers.d -p wa'
91 session:
92 enabled: true
93 rule_list:
94 - '-w /var/run/utmp -p wa'
95 - '-w /var/log/wtmp -p wa'
96 - '-w /var/log/btmp -p wa'
97 system_locale:
98 enabled: true
99 rule_list:
100 - '-a always,exit -F arch=b64 -S sethostname -S setdomainname'
101 - '-a always,exit -F arch=b32 -S sethostname -S setdomainname'
102 - '-w /etc/issue -p wa'
103 - '-w /etc/issue.net -p wa'
104 - '-w /etc/hosts -p wa'
105 - '-w /etc/network -p wa'
106 - '-w /etc/networks -p wa'
107 time_change:
108 enabled: true
109 rule_list:
110 - '-a always,exit -F arch=b64 -S adjtimex -S settimeofday'
111 - '-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime'
112 - '-a always,exit -F arch=b64 -S clock_settime'
113 - '-a always,exit -F arch=b32 -S clock_settime'
114 - '-w /etc/localtime -p wa'