blob: 8482c091c584c8d93766e5059b7f9b56bfd577da [file] [log] [blame]
Ivan Suzdal50a360f2018-06-04 16:07:41 +04001applications:
2- auditd
3classes:
4- service.auditd.support
5parameters:
6 auditd:
7 rules:
8 options:
9 enabled: 1
10 bufsize: 8192
11 rules:
12 MAC_policy:
13 enabled: true
14 rule_list:
15 - '-w /etc/apparmor/ -p wa'
16 - '-w /etc/apparmor.d/ -p wa'
17 access:
18 enabled: true
19 rule_list:
20 - '-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295'
21 - '-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295'
22 - '-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295'
23 - '-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295'
24 actions:
25 enabled: true
26 rule_list:
27 - '-w /var/log/sudo.log -p wa'
28 delete:
29 enabled: true
30 rule_list:
31 - '-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295'
32 - '-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295'
33 identity:
34 enabled: true
35 rule_list:
36 - '-w /etc/group -p wa'
37 - '-w /etc/passwd -p wa'
38 - '-w /etc/gshadow -p wa'
39 - '-w /etc/shadow -p wa'
40 - '-w /etc/security/opasswd -p wa'
41 logins:
42 enabled: true
43 rule_list:
44 - '-w /var/log/faillog -p wa'
45 - '-w /var/log/lastlog -p wa'
46 - '-w /var/log/tallylog -p wa'
47 modules:
48 enabled: true
49 rule_list:
50 - '-w /sbin/insmod -p x'
51 - '-w /sbin/rmmod -p x'
52 - '-w /sbin/modprobe -p x'
53 - '-a always,exit -F arch=b64 -S init_module -S delete_module'
54 mounts:
55 enabled: true
56 rule_list:
57 - '-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295'
58 - '-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295'
59 perm_mod:
60 enabled: true
61 rule_list:
62 - '-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295'
63 - '-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295'
64 - '-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295'
65 - '-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295'
66 - '-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295'
67 - '-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295'
68 privileged:
69 enabled: true
70 rule_list:
71 - '-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=4294967295'
72 - '-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=4294967295'
73 - '-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=4294967295'
74 - '-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=4294967295'
75 - '-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=4294967295'
76 - '-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=4294967295'
77 - '-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=4294967295'
78 - '-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=4294967295'
79 - '-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=4294967295'
80 - '-a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=4294967295'
81 - '-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295'
82 - '-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295'
83 - '-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=4294967295'
84 - '-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=4294967295'
85 - '-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=4294967295'
86 - '-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=4294967295'
87 scope:
88 enabled: true
89 rule_list:
90 - '-w /etc/sudoers -p wa'
91 - '-w /etc/sudoers.d -p wa'
92 session:
93 enabled: true
94 rule_list:
95 - '-w /var/run/utmp -p wa'
96 - '-w /var/log/wtmp -p wa'
97 - '-w /var/log/btmp -p wa'
98 system_locale:
99 enabled: true
100 rule_list:
101 - '-a always,exit -F arch=b64 -S sethostname -S setdomainname'
102 - '-a always,exit -F arch=b32 -S sethostname -S setdomainname'
103 - '-w /etc/issue -p wa'
104 - '-w /etc/issue.net -p wa'
105 - '-w /etc/hosts -p wa'
106 - '-w /etc/network -p wa'
107 - '-w /etc/networks -p wa'
108 time_change:
109 enabled: true
110 rule_list:
111 - '-a always,exit -F arch=b64 -S adjtimex -S settimeofday'
112 - '-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime'
113 - '-a always,exit -F arch=b64 -S clock_settime'
114 - '-a always,exit -F arch=b32 -S clock_settime'
115 - '-w /etc/localtime -p wa'