SLES-15-030730 'Record Unsuccessul Delete Attempts to Files - renameat2'

linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_renameat2/rule.yml

@@ -0,0 +1,51 @@
+documentation_complete: true
+
+prodtype: sle15
+
+title: 'Record Unsuccessul Delete Attempts to Files - renameat2'
+
+description: |-
+    The audit system should collect unsuccessful file deletion
+    attempts for all users and root. If the <tt>auditd</tt> daemon is configured
+    to use the <tt>augenrules</tt> program to read audit rules during daemon
+    startup (the default), add the following lines to a file with suffix
+    <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>.
+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
+    utility to read audit rules during daemon startup, add the following lines to
+    <tt>/etc/audit/audit.rules</tt> file.
+    <pre>-a always,exit -F arch=b32 -S renameat2 -F exit=-EACCES -F auid&gt;={{{ auid }}} -F auid!=unset -F key=unsuccessful-delete
+    -a always,exit -F arch=b32 -S renameat2 -F exit=-EPERM -F auid&gt;={{{ auid }}} -F auid!=unset -F key=unsuccessful-delete</pre>
+    If the system is 64 bit then also add the following lines:
+    <pre>
+    -a always,exit -F arch=b64 -S renameat2 -F exit=-EACCES -F auid&gt;={{{ auid }}} -F auid!=unset -F key=unsuccessful-delete
+    -a always,exit -F arch=b64 -S renameat2 -F exit=-EPERM -F auid&gt;={{{ auid }}} -F auid!=unset -F key=unsuccessful-delete</pre>
+
+rationale: |-
+    Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing
+    these events could serve as evidence of potential system compromise.
+
+severity: medium
+
+identifiers:
+    cce@sle15: CCE-85719-3
+
+references:
+    disa@sle15: CCI-000172
+    nist@sle15: AU-12(c),AU-12.1(iv)
+    srg@sle15: SRG-OS-000468-GPOS-00212
+    stigid@sle15: SLES-15-030730
+
+{{{ complete_ocil_entry_audit_syscall(syscall="renameat2") }}}
+
+warnings:
+    - general: |-
+        Note that these rules can be configured in a
+        number of ways while still achieving the desired effect. Here the system calls
+        have been placed independent of other system calls. Grouping system calls related
+        to the same event is more efficient. See the following example:
+        <pre>-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat,renameat2 -F exit=-EACCES -F auid>={{{ auid }}} -F auid!=unset -F key=unsuccesful-delete</pre>
+
+template:
+    name: audit_rules_unsuccessful_file_modification
+    vars:
+        name: renameat2

linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_renameat2/tests/ocp4/e2e.yml

@@ -0,0 +1,3 @@
+---
+default_result: FAIL
+result_after_remediation: PASS

sle15/profiles/stig.profile

@@ -125,6 +125,7 @@ selections:
     - audit_rules_unsuccessful_file_modification_openat
     - audit_rules_unsuccessful_file_modification_open_by_handle_at
     - audit_rules_unsuccessful_file_modification_renameat
+    - audit_rules_unsuccessful_file_modification_renameat2
     - audit_rules_unsuccessful_file_modification_rename
     - audit_rules_unsuccessful_file_modification_truncate
     - audit_rules_unsuccessful_file_modification_unlink

tests/shared/audit/30-ospp-v42-4-delete-failed.rules

@@ -1,5 +1,5 @@
 ## Unsuccessful file delete
--a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
--a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
--a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
--a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
+-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat,renameat2 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
+-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat,renameat2 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
+-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat,renameat2 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
+-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat,renameat2 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete

tests/shared/audit/30-ospp-v42-4-delete-success.rules

@@ -1,3 +1,3 @@
 ## Successful file delete
--a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
--a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
+-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat,renameat2 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
+-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat,renameat2 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete