auditd on nonexistent files

Hi all,

What is the best practice for using auditd for file integrity monitoring?

From the documentation, I have this, which works fine:
-a always,exit -F dir=/bin -F perm=wa

However, it seems that if I have a rule on a nonexistent directory, auditd will fail to add the rule (I assume because it's adding a watch on an inode or something like that?), but it will also just stop reading audit.rules and not add any subsequent rules.

This is bad in an environment where we have to have FIM for critical application files, but where another team may be maintaining some of the apps and therefore might remove some watched directories, especially as their mishaps may impact auditing for other parts of the system.

Can something be done to get better behaviour here?

I see two ways it could be better
1) (the ideal case) auditd will add rules even for nonexistent directories, and when they are created will add a watch for them. If a directory is removed and another created with the same name, auditd will add a watch on the new directory.

2) auditd still cannot add watches to nonexistent directories, but a failed rule add from audit.rules will become a warning rather than an error so subsequent watches still get added.

I suspect 1) is not possible, but can I get auditd to behave like in 2)?

Best regards,
Davíð

Quoted 20 lines · On Mon, 14 Sep 2015 16:01:17 +0000 Davíð Steinn Geirsson <[email protected]> wrote:

Hi all,

What is the best practice for using auditd for file integrity monitoring?

From the documentation, I have this, which works fine:
-a always,exit -F dir=/bin -F perm=wa

However, it seems that if I have a rule on a nonexistent directory, auditd will fail to add the rule (I assume because it's adding a watch on an inode or something like that?), but it will also just stop reading audit.rules and not add any subsequent rules.

This is bad in an environment where we have to have FIM for critical application files, but where another team may be maintaining some of the apps and therefore might remove some watched directories, especially as their mishaps may impact auditing for other parts of the system.

Quoted 7 lines

Can something be done to get better behaviour here?

I see two ways it could be better
1) (the ideal case) auditd will add rules even for nonexistent directories, and when they are created will add a watch for them. If a directory is removed and another created with the same name, auditd will add a watch on the new directory.

Which kernel are you using? I want to think this was fixed in kernels around 2.6.36 or later. This original problem was that the audit watches are based on inotify which needs an inode. If there's no inode, you can't place the watch.

Quoted 5 lines

2) auditd still cannot add watches to nonexistent directories, but a failed rule add from audit.rules will become a warning rather than an error so subsequent watches still get added.

Check into adding -i or -c near the top of your rules.

-Steve

Quoted 6 lines

I suspect 1) is not possible, but can I get auditd to behave like in 2)?

Best regards,
Davíð

Quoted 19 lines · On Mon, 14 Sep 2015 16:01:17 +0000 Davíð Steinn Geirsson <[email protected]> wrote:

Hi all,

What is the best practice for using auditd for file integrity monitoring?

From the documentation, I have this, which works fine:
-a always,exit -F dir=/bin -F perm=wa

However, it seems that if I have a rule on a nonexistent directory, auditd will fail to add the rule (I assume because it's adding a watch on an inode or something like that?), but it will also just stop reading audit.rules and not add any subsequent rules.

This is bad in an environment where we have to have FIM for critical application files, but where another team may be maintaining some of the apps and therefore might remove some watched directories, especially as their mishaps may impact auditing for other parts of the system.

Quoted 7 lines

Can something be done to get better behaviour here?

I see two ways it could be better
1) (the ideal case) auditd will add rules even for nonexistent directories, and when they are created will add a watch for them. If a directory is removed and another created with the same name, auditd will add a watch on the new directory.

Which kernel are you using? I want to think this was fixed in kernels around 2.6.36 or later. This original problem was that the audit watches are based on inotify which needs an inode. If there's no inode, you can't place the watch.

Quoted 3 lines

2) auditd still cannot add watches to nonexistent directories, but a failed rule add from audit.rules will become a warning rather than an error so subsequent watches still get added.

Check into adding -i or -c near the top of your rules.

-Steve

Quoted 2 lines

I suspect 1) is not possible, but can I get auditd to behave like in 2)?

Quoted 1 line

Davíð

Quoted 30 lines · Steve Grubb

Quoted 19 lines · On Mon, 14 Sep 2015 16:01:17 +0000 Davíð Steinn Geirsson <[email protected]> wrote:

Hi all,

What is the best practice for using auditd for file integrity monitoring?

From the documentation, I have this, which works fine:
-a always,exit -F dir=/bin -F perm=wa

However, it seems that if I have a rule on a nonexistent directory, auditd will fail to add the rule (I assume because it's adding a watch on an inode or something like that?), but it will also just stop reading audit.rules and not add any subsequent rules.

This is bad in an environment where we have to have FIM for critical application files, but where another team may be maintaining some of the apps and therefore might remove some watched directories, especially as their mishaps may impact auditing for other parts of the system.

Quoted 7 lines

Can something be done to get better behaviour here?

I see two ways it could be better
1) (the ideal case) auditd will add rules even for nonexistent directories, and when they are created will add a watch for them. If a directory is removed and another created with the same name, auditd will add a watch on the new directory.

Quoted 4 lines

Which kernel are you using? I want to think this was fixed in kernels around 2.6.36 or later. This original problem was that the audit watches are based on inotify which needs an inode. If there's no inode, you can't place the watch.

A watch can be added for a file that does not exist while the containing directory does, but a directory that does not exist (when the containing directory does not exist) does not work.

Quoted 4 lines

Quoted 3 lines

2) auditd still cannot add watches to nonexistent directories, but a failed rule add from audit.rules will become a warning rather than an error so subsequent watches still get added.

Quoted 6 lines

Check into adding -i or -c near the top of your rules.

-Steve

Quoted 2 lines

I suspect 1) is not possible, but can I get auditd to behave like in 2)?

1) is not currently implemented, but is worth discussing.

Quoted 1 line

Quoted 1 line

Davíð

I asked the same question in the "Watching over non-existent folder to maintain a generic audit.rules file" thread but got different hints. I've been directed to augenrules which could help but this doesn't really match or facilitate my needs to replace my current FIM tool by auditd which requires me to write a generic configuration with all possibles folders (including applicative ones) and deploy accross all hosts without knowing which host runs which app and/or contains which folders.