Suppress messages from /var/log/audit.log via audit.rules

[Steve Grubb]

On Tuesday, November 01, 2011 11:45:51 AM Worsham, Michael wrote:
> SRR still shows this as a failure, using stig.rules contents for
> audit.rules:
> 
> GEN002720: UNIX STIG: 3.16 - The audit system is not configured to audit
> failed attempts to access files and programs. AUDITING is NOT correctly
> CONFIGURED on va33-time.
> Ensure that -a exit,always -S open -F success=0 is in /etc/audit/audit.rules 

This ^^^ is wrong. For example, it does not limit the syscall by the arch. So what 
this means is that it will look up the open syscall for the arch that auditctl is. So, 
lets see what that does:

# ausyscall open
open               2

OK, now what does the 32 bit API think of it?
# ausyscall 2 i386
fork

So, that rule will watch for all 32 bit forks and 64 bit opens. Is that what your 
security folks want? 

Additionally, the intent of the STIG is to catch failed opens due to permission 
problems. You are going to trap normal system activity when glibc goes looking around 
for library resolution information. This will waste space in your logs and make it 
hard to find actual problems.


> PDI Number: GEN002720
> Finding Category: CAT II
> Reference: UNIX STIG: 3.16
> Description: The audit system is not configured to audit failed attempts to
> access files and programs. Status: Open
> 
> 
> Is there any documentation that says that the stig.rules file is compliant
> for GEN002720? 

There are no docs that I know of. I could write one, but would that be authoritative? 
:)

> The project security folks will only be looking at the SRR
> output, which says it's not.

And the SRR is completely wrong. So, they need to have some understanding that you 
either want a system configured right but failing the SRR's or matching the SRR's but 
configured wrong. I'd hate to be in your position, but that's where you are.
 
> We are using the rules as found here:
> https://fedorahosted.org/audit/browser/trunk/contrib/stig.rules

These rules are correct. You can contact DISA to verify.

-Steve