Use auditctl to load new rules #15

chewi · 2015-01-23T15:34:24Z

This is essential to get this cookbook working on CentOS 7. See the commit messages for details.

On discovering that none of the built in rules work on anything but RHEL or Fedora, I realised that adding support for those other platforms may have been a bit pointless but hey-ho.

Stopping and starting auditd is not the best way to load new rules. In fact, the systemd unit file actually prevents you from doing this. Debian patches this out but RHEL doesn't. auditctl can be used instead. We don't want this to happen on every chef-client run when handling built in rules so use the file resource instead of the remote_file or dumb execute resource. Experimental support has been added for loading built in rules on other platforms. Only Debian and CentOS has actually been tested.

/etc/sysconfig/network doesn't exist. This problem was masked until we switched to using auditctl to load the rules. Unfortunately, none of the other built in rules are compatible either.

shortdudey123 · 2015-02-03T06:41:45Z

.kitchen.yml

  attributes:
    auditd:
      ruleset: "stig"
+  excludes:
+    - ubuntu-12.04
+    - ubuntu-10.04


If stig doesn't work on ubuntu, you should pick another ruleset otherwise the ruleset attribute won't be tested on ubuntu with these excludes. :)

If you read the whole commit message, you'll see I discovered that none of
the other built in rules are compatible with Ubuntu either.

cis.rules does't work? default.rules doesn't work?

You still need to test rulesets even if the bulletins don't work :p

It still tests Ubuntu against the "rules" recipe, which uses default.rules. I only excluded it from the built-ins.

true, guess that is probably fine then

chewi · 2015-02-03T16:59:40Z

It's worth noting that these rulesets would probably work if they didn't reference /etc/sysconfig. It's a shame the distros haven't simply replaced these lines with something appropriate. I guess they didn't intend for you to simply use these files as-is.

shortdudey123 · 2015-02-03T17:02:36Z

providers/ruleset.rb

    source "#{new_resource.name}.erb"
-    notifies :restart, resources(service: 'auditd')
+    notifies :run, 'execute[auditctl -R]', :immediately


FYI switching this will probably break the usage of the init.d script on debian systems

which breaks backwards compatibility for those who have customized /etc/default/auditd

Please substantiate your claims.

The init.d script is still used to start auditd and so /etc/default/auditd is still used for EXTRAOPTIONS and USE_AUGENRULES on start, though the latter isn't really compatible with the cookbook anyway.

The cookbook will never and should never attempt to stop auditd so AUDITD_CLEAN_STOP and AUDITD_STOP_DISABLE will not be used in this context. That doesn't prevent them from being used on shutdown or if auditd is stopped manually.

I am working on a PR to bring this cookbook into compliance with the 2.3 changes (moving from a single file to multiple rule files) and the USE_AUGENRULES flag is needed on debian systems to turn the rules.d usage on.

Your change will just get reverted in my PR :p

Admittedly I am not yet overly familiar with auditd and was not aware of a push towards augenrules. It is a useful feature but I figured that Chef's flexibility negated the need for it. Feel free to add support for it and I will adjust this pull request accordingly but please do not throw false accusations around when my changes were correct for the cookbook in its current state. You may be trying to be funny but it isn't coming off very well.

Its easier to build it into the cookbook than have people create wrapper cookbooks :)
thanks!

shortdudey123 · 2015-02-03T17:35:23Z

This also fix CentOS 6.5/6.6? i noticed it doesn't converge on anything higher then CentOS 6.4

chewi · 2015-02-03T17:37:19Z

I think I only tested CentOS 7 (and Debian) but I will give 6.6 a try tomorrow.

shortdudey123 · 2015-02-03T17:43:10Z

thanks!

chewi · 2015-02-04T11:19:30Z

Turns out it's because Chef prepare their CentOS boxes with --excludedocs. This is true for CentOS 7 too but for some reason, the box I have still includes the docs anyway. It's not like they only added that directive recently either. I'm not sure what to do about this other than to exclude CentOS 6 from the built-in suite too. It would work fine on a real system.

shortdudey123 · 2015-02-04T16:56:43Z

Figures, thanks for looking into that part!
:)

isuftin · 2016-01-13T21:33:00Z

Is there any movement on this update? Currently trying to load auditd for CIS ruleset on CentOS 7.1 and it breaks with...

================================================================================
           Error executing action `restart` on resource 'service[auditd]'
           ================================================================================

           Mixlib::ShellOut::ShellCommandFailed
           ------------------------------------
           Expected process to exit with [0], but received '4'
           ---- Begin output of /bin/systemctl restart auditd ----
           STDOUT:
           STDERR: Failed to issue method call: Operation refused, unit auditd.service may be requested by dependency only.
           ---- End output of /bin/systemctl restart auditd ----
           Ran /bin/systemctl restart auditd returned 4

isuftin · 2016-01-13T21:33:55Z

Note that at the very least, any recipes calling :restart can call :reload and that should work fine. Unfortunately, the auditd cookbook hard-codes a restart once placing CIS rules.

chewi · 2017-06-12T16:18:36Z

We found that our fixes here were no longer working while the latest cookbook release now works fine so I'll close this.

chewi added 3 commits January 23, 2015 10:40

The "auditd" package name is the exception, not the rule

4ab7513

The stig rules are not compatible with Ubuntu

63faedd

/etc/sysconfig/network doesn't exist. This problem was masked until we switched to using auditctl to load the rules. Unfortunately, none of the other built in rules are compatible either.

shortdudey123 reviewed Feb 3, 2015
View reviewed changes

shortdudey123 mentioned this pull request Feb 4, 2015

CentOS and Fedora boxes packed without docs? chef/bento#317

Closed

chef-supermarket added the Signed CLA label Aug 11, 2016

tas50 removed the Signed CLA label Jan 5, 2017

chewi closed this Jun 12, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use auditctl to load new rules #15

Use auditctl to load new rules #15

chewi commented Jan 23, 2015

shortdudey123 Feb 3, 2015

chewi Feb 3, 2015

shortdudey123 Feb 3, 2015

shortdudey123 Feb 3, 2015

chewi Feb 3, 2015

shortdudey123 Feb 3, 2015

chewi commented Feb 3, 2015

shortdudey123 Feb 3, 2015

shortdudey123 Feb 3, 2015

chewi Feb 3, 2015

shortdudey123 Feb 3, 2015

chewi Feb 3, 2015

shortdudey123 Feb 3, 2015

shortdudey123 commented Feb 3, 2015

chewi commented Feb 3, 2015

shortdudey123 commented Feb 3, 2015

chewi commented Feb 4, 2015

shortdudey123 commented Feb 4, 2015

isuftin commented Jan 13, 2016

isuftin commented Jan 13, 2016

chewi commented Jun 12, 2017

Use auditctl to load new rules #15

Use auditctl to load new rules #15

Conversation

chewi commented Jan 23, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chewi commented Feb 3, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

shortdudey123 commented Feb 3, 2015

chewi commented Feb 3, 2015

shortdudey123 commented Feb 3, 2015

chewi commented Feb 4, 2015

shortdudey123 commented Feb 4, 2015

isuftin commented Jan 13, 2016

isuftin commented Jan 13, 2016

chewi commented Jun 12, 2017