-
Notifications
You must be signed in to change notification settings - Fork 73
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Errors with several auditd rules on ARM (aarch64) #38
Comments
hi @jakob-cf Thank you for the feedback, this will definitely require more thought. Requests along these lines which deviate from the official benchmark we generally only carry out if a client requests it under their agreement. Changes like this have a larger knock on affect to all the benchmarks we manage. Many thanks uk-bolly |
hi @uk-bolly, |
…sible-lockdown#38 by "blacklisting" the necessary modules along making them not loadable. Also, fixing the regexp for rule 1.1.10 so that the Ansible module modifies the needed file correctly. Signed-off-by: Diana-Maria Dumitru <diana.dumitru.ext@siemens.com>
Just wanted to lend my support for this issue. I was also unaware CIS benchmark is only for x86. I was also caught off guard when my auditd rules weren't working as expected. And this is because the actual behavior of After remediation on my ARM host, I ended up observing that a swath of rules that followed this line were unexpectedly never getting applied, because It would be a great addition to this framework to have ARM-compatible rules, even if they are technically a deviation from the absolute definition of the CIS benchmark. Perhaps it could be packaged as a separate, adjunct Ansible project, that way this project could stay true to the CIS benchmark? |
hi @joshavant and @jakob-cf Thank you again for your feedback on this issue, if you have a working config for arm based processors, Knowing which ones work and don't. I'm happy to update the template to carry out this work so that the playbook for for these chipsets as well. Noting this will become community supported option as not recognised by CIS. Maybe it easier to too and fro on discord? https://www.lockdownenterprise.com/discord many thanks uk-bolly |
Description:
Some auditd rules in
templates/audit/99_auditd.rules.j2
are incorrect for ARM systems. For example this line:-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
Expected Behavior
The correct auditd rules for the architecure should be used.
Actual Behavior
The following error occurs on ARM systems when auditd is restarted:
Control(s) Affected
ubtu22cis_rule_4_1_3_x
Environment:
Possible Solution
There should be a distinction for the different supported architectures (aarch64, x86_64, etc.) in
templates/audit/99_auditd.rules.j2
with each having the correct syscalls in the affected rules. Available syscalls can be checked with theausyscall
command.The following syscalls would need to be removed for aarch64:
arch=b64
: creat, open, chmod, chown, lchown, unlink, rename, create_module, query_modulearch=b32
: create_module, query_moduleI am not sure if any would need to be added instead.
The text was updated successfully, but these errors were encountered: