Information
Monitor for unsuccessful attempts to access files. The following parameters are associated with system calls that control files:
- creation - creat
- opening - open openat
- truncation - truncate ftruncate
An audit log record will only be written if all of the following criteria is met for the user when trying to access a file:
- a non-privileged user ( auid>=``UID_MIN )
- is not a Daemon event ( auid=``4294967295/unset/-1 )
- if the system call returned EACCES (permission denied) or EPERM (some other permanent error associated with the specific system call)
Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.
Satisfies: SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033
Solution
Note: The -w option is deprecated and the rule should be updated in accordance with the Remediation Procedure.
- Edit the /etc/login.defs file and create or add the UID_MIN setting.
Example
UID_MIN 1000 <xhtml:ol start="2"> - Edit or create a file in the /etc/audit/rules.d/ directory, ending inrules extension, with the relevant rules to monitor unsuccessful file access attempts.
Example:
# printf "
-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access
-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access
" >> /etc/audit/rules.d/50-access.rules
Note : The auid>= value should be set to the same value as UID_MIN value in /etc/login.defs
<xhtml:ol start="3"> - Merge and load the rules into active configuration:
# augenrules --load <xhtml:ol start="4"> - Check if reboot is required:
# if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi