* Does the order / position of audit rule's arguments matter?
[not found] <638619010.13827110.1421689227230.JavaMail.zimbra@redhat.com>
@ 2015-01-19 17:57 ` Jan Lieskovsky
2015-01-19 17:59 ` Steve Grubb
0 siblings, 1 reply; 6+ messages in thread
From: Jan Lieskovsky @ 2015-01-19 17:57 UTC (permalink / raw)
To: linux-audit; +Cc: Shawn Wells
Hello folks,
wasn't able to find answer to the following question in the auditctl
manual page, thus checking here - does the order / position in which the
auditctl's | /etc/audit/audit.rules' audit rule arguments are listed in
the rule matter or all permutations of the arguments are allowed?
IOW suppose the following rule:
-a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
Is
-a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
the only allowed form or are all the other possible argument permutations [*] also
valid / supported (under assumption there isn't some option missing or some new option
added of course when compared to the original rule)?
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
[*] For example suppose five different /etc/audit/audit.rules configurations would use the
forms as follows below - do all of them represent equivalent requirement / setting?
(regardless how much it's likely they would be expressed in that form of)
-a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
-F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged -a always,exit
-F perm=x -F auid>=500 -F auid!=4294967295 -k privileged -a always, exit -F path/bin/ping
-F auid>=500 -F auid!=4294967295 -k privileged -a always,exit -F path=/bin/ping -F perm=x
-F auid!=4294967295 -k privileged -a always,exit -F path=/bin/ping -F perm=x -F auid>=500
..
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Does the order / position of audit rule's arguments matter?
2015-01-19 17:57 ` Does the order / position of audit rule's arguments matter? Jan Lieskovsky
@ 2015-01-19 17:59 ` Steve Grubb
2015-01-19 18:06 ` Richard Guy Briggs
0 siblings, 1 reply; 6+ messages in thread
From: Steve Grubb @ 2015-01-19 17:59 UTC (permalink / raw)
To: linux-audit; +Cc: Jan Lieskovsky, Shawn Wells
On Monday, January 19, 2015 12:57:11 PM Jan Lieskovsky wrote:
> Hello folks,
>
> wasn't able to find answer to the following question in the auditctl
> manual page, thus checking here - does the order / position in which the
> auditctl's | /etc/audit/audit.rules' audit rule arguments are listed in
> the rule matter or all permutations of the arguments are allowed?
Yes, its a first match wins system. I tell people to order from specific to
general. IOW, put a watch on /etc/shadow before a watch on /etc.
-Steve
> IOW suppose the following rule:
> -a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F
> auid!=4294967295 -k privileged
>
> Is
> -a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F
> auid!=4294967295 -k privileged
>
> the only allowed form or are all the other possible argument permutations
> [*] also valid / supported (under assumption there isn't some option
> missing or some new option added of course when compared to the original
> rule)?
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> [*] For example suppose five different /etc/audit/audit.rules configurations
> would use the forms as follows below - do all of them represent equivalent
> requirement / setting? (regardless how much it's likely they would be
> expressed in that form of)
>
> -a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295
> -k privileged -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295
> -k privileged -a always,exit -F perm=x -F auid>=500 -F auid!=4294967295 -k
> privileged -a always, exit -F path/bin/ping -F auid>=500 -F
> auid!=4294967295 -k privileged -a always,exit -F path=/bin/ping -F perm=x
> -F auid!=4294967295 -k privileged -a always,exit -F path=/bin/ping -F
> perm=x -F auid>=500 ..
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Does the order / position of audit rule's arguments matter?
2015-01-19 17:59 ` Steve Grubb
@ 2015-01-19 18:06 ` Richard Guy Briggs
2015-01-19 18:11 ` Steve Grubb
0 siblings, 1 reply; 6+ messages in thread
From: Richard Guy Briggs @ 2015-01-19 18:06 UTC (permalink / raw)
To: Steve Grubb; +Cc: Jan Lieskovsky, Shawn Wells, linux-audit
On 15/01/19, Steve Grubb wrote:
> On Monday, January 19, 2015 12:57:11 PM Jan Lieskovsky wrote:
> > Hello folks,
> >
> > wasn't able to find answer to the following question in the auditctl
> > manual page, thus checking here - does the order / position in which the
> > auditctl's | /etc/audit/audit.rules' audit rule arguments are listed in
> > the rule matter or all permutations of the arguments are allowed?
>
> Yes, its a first match wins system. I tell people to order from specific to
> general. IOW, put a watch on /etc/shadow before a watch on /etc.
I don't think that answers Jan's question. I understood the question to
be the ordering of arguments *within* a rule. I believe the answer is
"no".
so:
-a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
would be equivalent to:
-a always,exit -F path=/bin/ping -F perm=x -F auid!=4294967295 -F auid>=500 -k privileged
> -Steve
>
> > IOW suppose the following rule:
> > -a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F
> > auid!=4294967295 -k privileged
> >
> > Is
> > -a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F
> > auid!=4294967295 -k privileged
> >
> > the only allowed form or are all the other possible argument permutations
> > [*] also valid / supported (under assumption there isn't some option
> > missing or some new option added of course when compared to the original
> > rule)?
> >
> > Thank you && Regards, Jan.
> > --
> > Jan iankko Lieskovsky / Red Hat Security Technologies Team
> >
> > [*] For example suppose five different /etc/audit/audit.rules configurations
> > would use the forms as follows below - do all of them represent equivalent
> > requirement / setting? (regardless how much it's likely they would be
> > expressed in that form of)
> >
> > -a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295
> > -k privileged -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295
> > -k privileged -a always,exit -F perm=x -F auid>=500 -F auid!=4294967295 -k
> > privileged -a always, exit -F path/bin/ping -F auid>=500 -F
> > auid!=4294967295 -k privileged -a always,exit -F path=/bin/ping -F perm=x
> > -F auid!=4294967295 -k privileged -a always,exit -F path=/bin/ping -F
> > perm=x -F auid>=500 ..
- RGB
--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Does the order / position of audit rule's arguments matter?
2015-01-19 18:06 ` Richard Guy Briggs
@ 2015-01-19 18:11 ` Steve Grubb
2015-01-19 18:19 ` Jan Lieskovsky
0 siblings, 1 reply; 6+ messages in thread
From: Steve Grubb @ 2015-01-19 18:11 UTC (permalink / raw)
To: Richard Guy Briggs; +Cc: Jan Lieskovsky, Shawn Wells, linux-audit
On Monday, January 19, 2015 01:06:42 PM Richard Guy Briggs wrote:
> On 15/01/19, Steve Grubb wrote:
> > On Monday, January 19, 2015 12:57:11 PM Jan Lieskovsky wrote:
> > > Hello folks,
> > >
> > > wasn't able to find answer to the following question in the auditctl
> > >
> > > manual page, thus checking here - does the order / position in which the
> > > auditctl's | /etc/audit/audit.rules' audit rule arguments are listed in
> > > the rule matter or all permutations of the arguments are allowed?
> >
> > Yes, its a first match wins system. I tell people to order from specific
> > to
> > general. IOW, put a watch on /etc/shadow before a watch on /etc.
>
> I don't think that answers Jan's question. I understood the question to
> be the ordering of arguments *within* a rule. I believe the answer is
> "no".
>
> so:
> -a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F
auid!=4294967295
> -k privileged would be equivalent to:
> -a always,exit -F path=/bin/ping -F perm=x -F auid!=4294967295 -F
auid>=500
> -k privileged
If that is the case, then you want to have the fields in the order in which the
system can decide "no" as fast as possible.
-Steve
> > -Steve
> >
> > > IOW suppose the following rule:
> > > -a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F
> > >
> > > auid!=4294967295 -k privileged
> > >
> > > Is
> > >
> > > -a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F
> > >
> > > auid!=4294967295 -k privileged
> > >
> > > the only allowed form or are all the other possible argument
> > > permutations
> > > [*] also valid / supported (under assumption there isn't some option
> > > missing or some new option added of course when compared to the original
> > > rule)?
> > >
> > > Thank you && Regards, Jan.
> > > --
> > > Jan iankko Lieskovsky / Red Hat Security Technologies Team
> > >
> > > [*] For example suppose five different /etc/audit/audit.rules
> > > configurations would use the forms as follows below - do all of them
> > > represent equivalent requirement / setting? (regardless how much it's
> > > likely they would be expressed in that form of)
> > >
> > > -a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F
> > > auid!=4294967295
> > > -k privileged -F path=/bin/ping -F perm=x -F auid>=500 -F
> > > auid!=4294967295
> > > -k privileged -a always,exit -F perm=x -F auid>=500 -F auid!=4294967295
> > > -k
> > > privileged -a always, exit -F path/bin/ping -F auid>=500 -F
> > > auid!=4294967295 -k privileged -a always,exit -F path=/bin/ping -F
> > > perm=x
> > > -F auid!=4294967295 -k privileged -a always,exit -F path=/bin/ping -F
> > > perm=x -F auid>=500 ..
>
> - RGB
>
> --
> Richard Guy Briggs <rbriggs@redhat.com>
> Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems,
> Red Hat Remote, Ottawa, Canada
> Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Does the order / position of audit rule's arguments matter?
2015-01-19 18:11 ` Steve Grubb
@ 2015-01-19 18:19 ` Jan Lieskovsky
2015-01-25 18:05 ` Steve Grubb
0 siblings, 1 reply; 6+ messages in thread
From: Jan Lieskovsky @ 2015-01-19 18:19 UTC (permalink / raw)
To: Steve Grubb; +Cc: Richard Guy Briggs, Shawn Wells, linux-audit
Thank you both for quick replies.
----- Original Message -----
> From: "Steve Grubb" <sgrubb@redhat.com>
> To: "Richard Guy Briggs" <rgb@redhat.com>
> Cc: linux-audit@redhat.com, "Jan Lieskovsky" <jlieskov@redhat.com>, "Shawn Wells" <shawn@redhat.com>
> Sent: Monday, January 19, 2015 7:11:10 PM
> Subject: Re: Does the order / position of audit rule's arguments matter?
>
> On Monday, January 19, 2015 01:06:42 PM Richard Guy Briggs wrote:
> > On 15/01/19, Steve Grubb wrote:
> > > On Monday, January 19, 2015 12:57:11 PM Jan Lieskovsky wrote:
> > > > Hello folks,
> > > >
> > > > wasn't able to find answer to the following question in the auditctl
> > > >
> > > > manual page, thus checking here - does the order / position in which
> > > > the
> > > > auditctl's | /etc/audit/audit.rules' audit rule arguments are listed in
> > > > the rule matter or all permutations of the arguments are allowed?
> > >
> > > Yes, its a first match wins system. I tell people to order from specific
> > > to
> > > general. IOW, put a watch on /etc/shadow before a watch on /etc.
> >
> > I don't think that answers Jan's question. I understood the question to
> > be the ordering of arguments *within* a rule.
Yes, was about this case. But good to know also order of rules matters
(to list them that way).
> I believe the answer is
> > "no".
> >
> > so:
> > -a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F
> auid!=4294967295
> > -k privileged would be equivalent to:
> > -a always,exit -F path=/bin/ping -F perm=x -F auid!=4294967295 -F
> auid>=500
> > -k privileged
>
> If that is the case, then you want to have the fields in the order in which
> the
> system can decide "no" as fast as possible.
Meaning the audit rule's arguments to be sorted? Or just follow the form
as it's listed for example in /usr/share/doc/audit-2.3.7/stig.rules file?
(IOW action first, then path to binary, then other -F arguments - for these
to be listed in ascending alphabetical order?)
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> -Steve
>
>
> > > -Steve
> > >
> > > > IOW suppose the following rule:
> > > > -a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F
> > > >
> > > > auid!=4294967295 -k privileged
> > > >
> > > > Is
> > > >
> > > > -a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F
> > > >
> > > > auid!=4294967295 -k privileged
> > > >
> > > > the only allowed form or are all the other possible argument
> > > > permutations
> > > > [*] also valid / supported (under assumption there isn't some option
> > > > missing or some new option added of course when compared to the
> > > > original
> > > > rule)?
> > > >
> > > > Thank you && Regards, Jan.
> > > > --
> > > > Jan iankko Lieskovsky / Red Hat Security Technologies Team
> > > >
> > > > [*] For example suppose five different /etc/audit/audit.rules
> > > > configurations would use the forms as follows below - do all of them
> > > > represent equivalent requirement / setting? (regardless how much it's
> > > > likely they would be expressed in that form of)
> > > >
> > > > -a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F
> > > > auid!=4294967295
> > > > -k privileged -F path=/bin/ping -F perm=x -F auid>=500 -F
> > > > auid!=4294967295
> > > > -k privileged -a always,exit -F perm=x -F auid>=500 -F auid!=4294967295
> > > > -k
> > > > privileged -a always, exit -F path/bin/ping -F auid>=500 -F
> > > > auid!=4294967295 -k privileged -a always,exit -F path=/bin/ping -F
> > > > perm=x
> > > > -F auid!=4294967295 -k privileged -a always,exit -F path=/bin/ping -F
> > > > perm=x -F auid>=500 ..
> >
> > - RGB
> >
> > --
> > Richard Guy Briggs <rbriggs@redhat.com>
> > Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems,
> > Red Hat Remote, Ottawa, Canada
> > Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Does the order / position of audit rule's arguments matter?
2015-01-19 18:19 ` Jan Lieskovsky
@ 2015-01-25 18:05 ` Steve Grubb
0 siblings, 0 replies; 6+ messages in thread
From: Steve Grubb @ 2015-01-25 18:05 UTC (permalink / raw)
To: Jan Lieskovsky; +Cc: Richard Guy Briggs, Shawn Wells, linux-audit
On Monday, January 19, 2015 01:19:16 PM Jan Lieskovsky wrote:
> Thank you both for quick replies.
>
> ----- Original Message -----
>
> > From: "Steve Grubb" <sgrubb@redhat.com>
> > To: "Richard Guy Briggs" <rgb@redhat.com>
> > Cc: linux-audit@redhat.com, "Jan Lieskovsky" <jlieskov@redhat.com>, "Shawn
> > Wells" <shawn@redhat.com> Sent: Monday, January 19, 2015 7:11:10 PM
> > Subject: Re: Does the order / position of audit rule's arguments matter?
> >
> > On Monday, January 19, 2015 01:06:42 PM Richard Guy Briggs wrote:
> > > On 15/01/19, Steve Grubb wrote:
> > > > On Monday, January 19, 2015 12:57:11 PM Jan Lieskovsky wrote:
> > > > > Hello folks,
> > > > >
> > > > > wasn't able to find answer to the following question in the
> > > > > auditctl
> > > > >
> > > > > manual page, thus checking here - does the order / position in which
> > > > > the
> > > > > auditctl's | /etc/audit/audit.rules' audit rule arguments are listed
> > > > > in
> > > > > the rule matter or all permutations of the arguments are allowed?
> > > >
> > > > Yes, its a first match wins system. I tell people to order from
> > > > specific
> > > > to
> > > > general. IOW, put a watch on /etc/shadow before a watch on /etc.
> > >
> > > I don't think that answers Jan's question. I understood the question to
> > > be the ordering of arguments *within* a rule.
>
> Yes, was about this case. But good to know also order of rules matters
> (to list them that way).
>
> > I believe the answer is
> >
> > > "no".
> > >
> > > so:
> > > -a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F
> >
> > auid!=4294967295
> >
> > > -k privileged would be equivalent to:
> > > -a always,exit -F path=/bin/ping -F perm=x -F auid!=4294967295 -F
> >
> > auid>=500
> >
> > > -k privileged
> >
> > If that is the case, then you want to have the fields in the order in
> > which
> > the
> > system can decide "no" as fast as possible.
>
> Meaning the audit rule's arguments to be sorted? Or just follow the form
> as it's listed for example in /usr/share/doc/audit-2.3.7/stig.rules file?
> (IOW action first, then path to binary, then other -F arguments - for these
> to be listed in ascending alphabetical order?)
Yes, the audit system is like
for each rule
if (syscall & mask)
for each field
if fval != rval
next rule
endif
done
record event
endif
done
So, by deciding "no" quickly, it can move on to the next rule to iterate over
the fields.
The stig.rules is ordered correctly and is intended that anyone that needs to
STIG a box simply copies the file "as is" to the rules.d directory. Any
problems between what the file has and what's needed should be reported here so
the file can be corrected.
-Steve
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2015-01-25 18:05 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <638619010.13827110.1421689227230.JavaMail.zimbra@redhat.com>
2015-01-19 17:57 ` Does the order / position of audit rule's arguments matter? Jan Lieskovsky
2015-01-19 17:59 ` Steve Grubb
2015-01-19 18:06 ` Richard Guy Briggs
2015-01-19 18:11 ` Steve Grubb
2015-01-19 18:19 ` Jan Lieskovsky
2015-01-25 18:05 ` Steve Grubb
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.