1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
{{%- if product in ["almalinux9", "debian12", "debian13", "fedora", "ol7", "ol8", "ol9", "ol10", "rhel8", "rhel9", "rhel10", "sle12", "sle15", "slmicro5", "slmicro6", "ubuntu2204", "ubuntu2404"] %}}
{{%- set perm_x="(?:[\s]+-F[\s]+perm=x)" %}}
{{%- endif %}}
<def-group>
<definition class="compliance" id="{{{ rule_id }}}" version="1">
{{{ oval_metadata("Audit rules about the information on the use of " + NAME + " is enabled.", rule_title=rule_title) }}}
<criteria operator="OR">
{{% for audit_tool in ["augenrules", "auditctl"] %}}
<!-- Test the {{{ audit_tool }}} case -->
<criteria operator="AND">
<extend_definition comment="audit {{{ audit_tool }}}" definition_ref="audit_rules_{{{ audit_tool }}}" />
{{% if product == "rhel10" %}}
<criterion comment="audit {{{ audit_tool }}} 32-bit {{{ NAME }}}" test_ref="test_{{{ rule_id }}}_{{{ audit_tool }}}_32bit" />
<criteria operator="OR">
<!-- System either isn't 64-bit => we just check presence of 32-bit version of {{{ NAME }}} audit rule -->
<extend_definition comment="64-bit system" definition_ref="system_info_architecture_64bit" negate="true" />
<!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of {{{ NAME }}} audit rule -->
<criterion comment="audit {{{ audit_tool }}} 64-bit {{{ NAME }}}" test_ref="test_{{{ rule_id }}}_{{{ audit_tool }}}_64bit" />
</criteria>
{{% else %}}
<criterion comment="audit {{{ audit_tool }}} {{{ NAME }}}" test_ref="test_{{{ rule_id }}}_{{{ audit_tool }}}" />
{{% endif %}}
</criteria>
{{% endfor %}}
</criteria>
</definition>
{{% macro arpc_tftst(audit_tool, bits=None) %}}
{{% set id_root = rule_id ~ "_" ~ audit_tool %}}
{{% set arch_regex = "" %}}
{{% if bits != None %}}
{{% set id_root = id_root ~ "_" ~ bits ~ "bit" %}}
{{% set arch_regex = "-F[\s]+arch=b" ~ bits ~ "[\s]+" %}}
{{% endif %}}
{{% if audit_tool == "augenrules" %}}
{{% set filepath = "^/etc/audit/rules\.d/.*\.rules$" %}}
{{% elif audit_tool == "auditctl" %}}
{{% set filepath = "/etc/audit/audit.rules" %}}
{{% endif %}}
<ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit {{{ audit_tool }}} {{{ NAME }}}" id="test_{{{ id_root }}}" version="1">
<ind:object object_ref="object_{{{ id_root }}}" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_{{{ id_root }}}" version="1">
<ind:filepath operation="pattern match">{{{ filepath }}}</ind:filepath>
<ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+{{{ arch_regex }}}-F[\s]+path={{{ PATH }}}{{{ perm_x }}}[\s]+-F[\s]+auid>={{{ auid }}}[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
{{% endmacro %}}
{{% for audit_tool in ["augenrules", "auditctl"] %}}
{{% if product == "rhel10" %}}
{{{ arpc_tftst(audit_tool, "32") }}}
{{{ arpc_tftst(audit_tool, "64") }}}
{{% else %}}
{{{ arpc_tftst(audit_tool) }}}
{{% endif %}}
{{% endfor %}}
</def-group>
|
