Ensure use of privileged commands are collected

ThấpCấp 2Tự độnglinux

Mô tả

Monitor privileged programs, those that have the setuid and/or setgid bit set on execution, to determine if unprivileged users are running these commands.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   UID_MIN="$(awk '"'"'/^\s*UID_MIN/{print $2}'"'"' /etc/login.defs)"
   for PARTITION in $(findmnt -n -l -k -it $(awk '"'"'/nodev/ { print $2 }'"'"' /proc/filesystems | paste -sd,) | grep -Pv "noexec|nosuid" | awk '"'"'{print $1}'"'"'); do
      while IFS= read -r FILE; do
         ok=""
         while IFS= read -r L; do
            grep -Pq -- '"'"'-a\s+(always,exit|exit,always)'"'"' <<< "$L" \
            && grep -Pq -- '"'"'-F\s+perm=x'"'"' <<< "$L" \
            && grep -Pq -- "-F\s+auid>=${UID_MIN}" <<< "$L" \
            && grep -Pq -- '"'"'-F\s+auid!=(unset|-1|4294967295)'"'"' <<< "$L" && ok="Y"
         done < <(grep -h -- "path=${FILE}" /etc/audit/rules.d/*.rules 2>/dev/null)
         [ -z "$ok" ] && printf '"'"'MISSING or incomplete on-disk rule: %s\n'"'"' "$FILE"
      done < <(find "${PARTITION}" -xdev \( -path "*/containers/storage/*" -o -path "*/containerd/*" -o -path "*/kubelet/*" -o -path "/snap/*" \) -prune -o -perm /6000 -type f -print)
   done
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; o=$(bash -c '#!/usr/bin/env bash

{
   UID_MIN="$(awk '"'"'/^\s*UID_MIN/{print $2}'"'"' /etc/login.defs)"
   RUNNING="$(auditctl -l)"
   for PARTITION in $(findmnt -n -l -k -it $(awk '"'"'/nodev/ { print $2 }'"'"' /proc/filesystems | paste -sd,) | grep -Pv "noexec|nosuid" | awk '"'"'{print $1}'"'"'); do
      while IFS= read -r FILE; do
         ok=""
         while IFS= read -r L; do
            grep -Pq -- '"'"'-a\s+(always,exit|exit,always)'"'"' <<< "$L" \
            && grep -Pq -- '"'"'-F\s+perm=x'"'"' <<< "$L" \
            && grep -Pq -- "-F\s+auid>=${UID_MIN}" <<< "$L" \
            && grep -Pq -- '"'"'-F\s+auid!=(unset|-1|4294967295)'"'"' <<< "$L" && ok="Y"
         done < <(printf '"'"'%s\n'"'"' "$RUNNING" | grep -- "path=${FILE}")
         [ -z "$ok" ] && printf '"'"'MISSING or incomplete loaded rule: %s\n'"'"' "$FILE"
      done < <(find "${PARTITION}" -xdev \( -path "*/containers/storage/*" -o -path "*/containerd/*" -o -path "*/kubelet/*" -o -path "/snap/*" \) -prune -o -perm /6000 -type f -print)
   done
}' 2>&1); [ -z "$o" ] || { echo "step2: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor the use of privileged commands. Example script: #!/usr/bin/env bash { UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs) AUDIT_RULE_FILE="/etc/audit/rules.d/50-privileged.rules" # Emit a rule only for the audit ABIs the running kernel supports ARCHES=""; for ARCH in b64 b32; do ausyscall "$ARCH" execve >/dev/null 2>&1 && ARCHES="${ARCHES:+$ARCHES }$ARCH"; done NEW_DATA=() for PARTITION in $(findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,) | grep -Pv "noexec|nosuid" | awk '{print $1}'); do while IFS= read -r FILE; do for ARCH in $ARC…

Thuộc tính

Hệ điều hành: rocky-9
Thẻ: cis-convertedlinux
Tham chiếu: CIS Rocky Linux 9 Benchmark v3.0.0 - 6.2.3.10

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target linux --level 2