Ensure use of privileged commands are collected

BaixaNível 2Automatizadalinux

Descrição

Monitor privileged programs, those that have the setuid and/or setgid bit set on execution, to determine if unprivileged users are running these commands.

Como é verificado

Método de auditoria: Comando shell

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   UID_MIN="$(awk '"'"'/^\s*UID_MIN/{print $2}'"'"' /etc/login.defs)"
   for PARTITION in $(findmnt -n -l -k -it $(awk '"'"'/nodev/ { print $2 }'"'"' /proc/filesystems | paste -sd,) | grep -Pv "noexec|nosuid" | awk '"'"'{print $1}'"'"'); do
      while IFS= read -r FILE; do
         ok=""
         while IFS= read -r L; do
            grep -Pq -- '"'"'-a\s+(always,exit|exit,always)'"'"' <<< "$L" \
            && grep -Pq -- '"'"'-F\s+perm=x'"'"' <<< "$L" \
            && grep -Pq -- "-F\s+auid>=${UID_MIN}" <<< "$L" \
            && grep -Pq -- '"'"'-F\s+auid!=(unset|-1|4294967295)'"'"' <<< "$L" && ok="Y"
         done < <(grep -h -- "path=${FILE}" /etc/audit/rules.d/*.rules 2>/dev/null)
         [ -z "$ok" ] && printf '"'"'MISSING or incomplete on-disk rule: %s\n'"'"' "$FILE"
      done < <(find "${PARTITION}" -xdev \( -path "*/containers/storage/*" -o -path "*/containerd/*" -o -path "*/kubelet/*" -o -path "/snap/*" \) -prune -o -perm /6000 -type f -print)
   done
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; o=$(bash -c '#!/usr/bin/env bash

{
   UID_MIN="$(awk '"'"'/^\s*UID_MIN/{print $2}'"'"' /etc/login.defs)"
   RUNNING="$(auditctl -l)"
   for PARTITION in $(findmnt -n -l -k -it $(awk '"'"'/nodev/ { print $2 }'"'"' /proc/filesystems | paste -sd,) | grep -Pv "noexec|nosuid" | awk '"'"'{print $1}'"'"'); do
      while IFS= read -r FILE; do
         ok=""
         while IFS= read -r L; do
            grep -Pq -- '"'"'-a\s+(always,exit|exit,always)'"'"' <<< "$L" \
            && grep -Pq -- '"'"'-F\s+perm=x'"'"' <<< "$L" \
            && grep -Pq -- "-F\s+auid>=${UID_MIN}" <<< "$L" \
            && grep -Pq -- '"'"'-F\s+auid!=(unset|-1|4294967295)'"'"' <<< "$L" && ok="Y"
         done < <(printf '"'"'%s\n'"'"' "$RUNNING" | grep -- "path=${FILE}")
         [ -z "$ok" ] && printf '"'"'MISSING or incomplete loaded rule: %s\n'"'"' "$FILE"
      done < <(find "${PARTITION}" -xdev \( -path "*/containers/storage/*" -o -path "*/containerd/*" -o -path "*/kubelet/*" -o -path "/snap/*" \) -prune -o -perm /6000 -type f -print)
   done
}' 2>&1); [ -z "$o" ] || { echo "step2: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor the use of privileged commands. Example script: #!/usr/bin/env bash { UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs) AUDIT_RULE_FILE="/etc/audit/rules.d/50-privileged.rules" # Emit a rule only for the audit ABIs the running kernel supports ARCHES=""; for ARCH in b64 b32; do ausyscall "$ARCH" execve >/dev/null 2>&1 && ARCHES="${ARCHES:+$ARCHES }$ARCH"; done NEW_DATA=() for PARTITION in $(findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,) | grep -Pv "noexec|nosuid" | awk '{print $1}'); do while IFS= read -r FILE; do for ARCH in $ARC…

Propriedades

Sistemas operacionais: rocky-9
Tags: cis-convertedlinux
Referência: CIS Rocky Linux 9 Benchmark v3.0.0 - 6.2.3.10

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target linux --level 2