perhaps obvious question: auditd and setuid/setgid?

[John Jasen]

I was specifically wondering if I was missing the appropriate syscall
for the use of setuid or setgid.

>From a brief examination and test, this appears to not be the case?



On 09/02/2015 10:32 PM, rshaw1 at umbc.edu wrote:
>> I'm currently testing auditd with rules for setuid or setgid binaries on
>> the system.
>>
>> I currently maintain the list via find, and pushing the results to a
>> audit.rules file.
>>
>> I'm hoping there's a cleaner way, perhaps by triggering on the
>> appropriate syscall -- but have not discovered it.
>>
>> Is there an easier method?
> The find method is what I use (though I push it to a file in rules.d and
> then run augenrules, which for RHEL5/6 I just stole from RHEL7).  Using
> find to generate these rules is actually in the text of, IIRC, at least
> one of the RHEL STIGs (6, draft of 7, possibly both), though not quite as
> automated as the way I do it.
>
> --Ray
>