Detections
Analytics
4.1.3.7 Ensure unsuccessful file access attempts are collected - b32 EPERM
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
Monitor for unsuccessful attempts to access files. The following parameters are associated with system calls that control files:creation - creat
opening - open , openat
truncation - truncate , ftruncate
An audit log record will only be written if all of the following criteria is met for the user when trying to access a file:
a non-privileged user (auid>=UID_MIN)
is not a Daemon event (auid=4294967295/unset/-1)
if the system call returned EACCES (permission denied) or EPERM (some other permanent error associated with the specific system call)
Rationale:
Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.
Solution
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rulesCreate audit rules
Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor unsuccessful file access attempts.
64 Bit systems
Example:
# UID_MIN=$(awk '/^s*UID_MIN/{print $2}' /etc/login.defs)
# [ -n '${UID_MIN}' ] && printf '
-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=${UID_MIN} -F auid!=unset -k access
-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=${UID_MIN} -F auid!=unset -k access
-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=${UID_MIN} -F auid!=unset -k access
-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=${UID_MIN} -F auid!=unset -k access
' >> /etc/audit/rules.d/50-access.rules
|| printf 'ERROR: Variable 'UID_MIN' is unset.
'
Load audit rules
Merge and load the rules into active configuration:
# augenrules --load
Check if reboot is required.
# if [[ $(auditctl -s | grep 'enabled') =~ '2' ]]; then printf 'Reboot required to load rules
'; fi
32 Bit systems
Follow the same procedures as for 64 bit systems and ignore any entries with b64.
Additional Information:
Potential reboot required
If the auditing configuration is locked (-e 2), then augenrules will not warn in any way that rules could not be loaded into the running configuration. A system reboot will be required to load the rules into the running configuration.
System call structure
For performance (man 7 audit.rules) reasons it is preferable to have all the system calls on one line. However, your configuration may have them on one line each or some other combination. This is important to understand for both the auditing and remediation sections as the examples given are optimized for performance as per the man page.
See Also
Item Details
Audit Name: CIS Red Hat EL8 Workstation L2 v2.0.0
References: CSCv7|14.9
Plugin: Unix
Control ID: b8c56e877072274fd31dee2a96db3977d9950f3b5623da6e82e8cdee41af5a2c