| Ivan Suzdal | 50a360f | 2018-06-04 16:07:41 +0400 | [diff] [blame] | 1 | applications: |
| 2 | - auditd |
| 3 | classes: |
| 4 | - service.auditd.support |
| 5 | parameters: |
| 6 | auditd: |
| 7 | rules: |
| 8 | options: |
| 9 | enabled: 1 |
| 10 | bufsize: 8192 |
| 11 | rules: |
| 12 | MAC_policy: |
| 13 | enabled: true |
| 14 | rule_list: |
| 15 | - '-w /etc/apparmor/ -p wa' |
| 16 | - '-w /etc/apparmor.d/ -p wa' |
| 17 | access: |
| 18 | enabled: true |
| 19 | rule_list: |
| 20 | - '-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295' |
| 21 | - '-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295' |
| 22 | - '-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295' |
| 23 | - '-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295' |
| 24 | actions: |
| 25 | enabled: true |
| 26 | rule_list: |
| 27 | - '-w /var/log/sudo.log -p wa' |
| 28 | delete: |
| 29 | enabled: true |
| 30 | rule_list: |
| 31 | - '-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295' |
| 32 | - '-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295' |
| 33 | identity: |
| 34 | enabled: true |
| 35 | rule_list: |
| 36 | - '-w /etc/group -p wa' |
| 37 | - '-w /etc/passwd -p wa' |
| 38 | - '-w /etc/gshadow -p wa' |
| 39 | - '-w /etc/shadow -p wa' |
| 40 | - '-w /etc/security/opasswd -p wa' |
| 41 | logins: |
| 42 | enabled: true |
| 43 | rule_list: |
| 44 | - '-w /var/log/faillog -p wa' |
| 45 | - '-w /var/log/lastlog -p wa' |
| 46 | - '-w /var/log/tallylog -p wa' |
| 47 | modules: |
| 48 | enabled: true |
| 49 | rule_list: |
| 50 | - '-w /sbin/insmod -p x' |
| 51 | - '-w /sbin/rmmod -p x' |
| 52 | - '-w /sbin/modprobe -p x' |
| 53 | - '-a always,exit -F arch=b64 -S init_module -S delete_module' |
| 54 | mounts: |
| 55 | enabled: true |
| 56 | rule_list: |
| 57 | - '-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295' |
| 58 | - '-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295' |
| 59 | perm_mod: |
| 60 | enabled: true |
| 61 | rule_list: |
| 62 | - '-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295' |
| 63 | - '-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295' |
| 64 | - '-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295' |
| 65 | - '-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295' |
| 66 | - '-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295' |
| 67 | - '-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295' |
| 68 | privileged: |
| 69 | enabled: true |
| 70 | rule_list: |
| 71 | - '-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=4294967295' |
| 72 | - '-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=4294967295' |
| 73 | - '-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=4294967295' |
| 74 | - '-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=4294967295' |
| 75 | - '-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=4294967295' |
| 76 | - '-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=4294967295' |
| 77 | - '-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=4294967295' |
| 78 | - '-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=4294967295' |
| 79 | - '-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=4294967295' |
| 80 | - '-a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=4294967295' |
| 81 | - '-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295' |
| 82 | - '-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295' |
| 83 | - '-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=4294967295' |
| 84 | - '-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=4294967295' |
| 85 | - '-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=4294967295' |
| 86 | - '-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=4294967295' |
| 87 | scope: |
| 88 | enabled: true |
| 89 | rule_list: |
| 90 | - '-w /etc/sudoers -p wa' |
| 91 | - '-w /etc/sudoers.d -p wa' |
| 92 | session: |
| 93 | enabled: true |
| 94 | rule_list: |
| 95 | - '-w /var/run/utmp -p wa' |
| 96 | - '-w /var/log/wtmp -p wa' |
| 97 | - '-w /var/log/btmp -p wa' |
| 98 | system_locale: |
| 99 | enabled: true |
| 100 | rule_list: |
| 101 | - '-a always,exit -F arch=b64 -S sethostname -S setdomainname' |
| 102 | - '-a always,exit -F arch=b32 -S sethostname -S setdomainname' |
| 103 | - '-w /etc/issue -p wa' |
| 104 | - '-w /etc/issue.net -p wa' |
| 105 | - '-w /etc/hosts -p wa' |
| 106 | - '-w /etc/network -p wa' |
| 107 | - '-w /etc/networks -p wa' |
| 108 | time_change: |
| 109 | enabled: true |
| 110 | rule_list: |
| 111 | - '-a always,exit -F arch=b64 -S adjtimex -S settimeofday' |
| 112 | - '-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime' |
| 113 | - '-a always,exit -F arch=b64 -S clock_settime' |
| 114 | - '-a always,exit -F arch=b32 -S clock_settime' |
| 115 | - '-w /etc/localtime -p wa' |