From where ANOM_MK_EXEC , ANOM_ROOT_TRANS ,comes ?
Steve Grubb
sgrubb at redhat.com
Sun May 21 00:20:42 UTC 2017
On Saturday, May 20, 2017 9:04:37 AM EDT Lev Olshvang wrote:
> Hello list
>
>
> There are particularly interesting for IDS evens , like ANOM_MK_EXEC ,
This was in the now defunct prelude plugin.
> ANOM_ROOT_TRANS These audit events are listed in RHEL7 Security guide.
Not sure where this one is. But the main thing is that the ANOM and RESP
classes of events are for use by IDS and IPS respectively. I have been slowly
working my way back up the stack with the aim of providing and basic IDS/IPS
plugin that will generate all these events. I think many of ANOM ones were in
the prelude plugin and will be used again. For now they are placeholders.
-Steve
> On my Ubuntu distro they are absent on user space level
> /usr/include/linux/audit.h
>
> I have RHEL7 kernel sourcel linux-3.10.0-514.16.1.el7 which I downloaded
> from Centos
>
>
> ANOM_MK_EXE, ANOM_ROOT_TRANS does not appear there, neither in include
>
> linux-3.10.0-514.16.1.el7/include/uapi/linux/audit.h nor in c files
>
>
> Please help me to unsderstand who sends these events ?
>
>
> ThanX,
> Lev
>
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
More information about the Linux-audit
mailing list