Linux Audit System (im_linuxaudit)

With this module, NXLog Agent can set up Audit rules and collect the resulting logs directly from the kernel without requiring auditd or other user-space software. If the auditd service is installed, it must not be running.

Rules must be provided using at least one of the LoadRule and Rules directives. Rules should be specified using the format documented in the Defining Persistent Audit Rules section of the Red Hat Enterprise Linux Security Guide.

The -e control rule should be included in the ruleset to enable the Audit system (as -e 1 or -e 2). Rules are not automatically removed, either before applying a ruleset or when NXLog Agent exits. To clear the current ruleset before setting rules, begin the ruleset with the -D rule. If the Audit configuration is locked when im_linuxaudit starts, NXLog Agent will print a warning and collect events generated by the active ruleset.

It is recommended that FlowControl be disabled for im_linuxaudit module instances. If the im_linuxaudit module instance is suspended and the Audit backlog limit is exceeded, all processes that generate Audit messages will be blocked.

Configuration

The im_linuxaudit module accepts the following directives in addition to the common module directives. At least one of LoadRule and Rules must be specified.

Required directives

The following directives are required for the module to start.

LoadRule

Use this directive to load a ruleset from an external rules file. This directive can be used more than once. Wildcards can be used to read rules from multiple files.

Rules

This directive, specified as a block, can be used to provide Audit rules directly from the NXLog Agent configuration file. The following control rules are supported: -b, -D, -e, -f, -r,--loginuid-immutable, --backlog_wait_time, and --reset-lost; see auditctl(8) for more information. Include::: This directive can be used inside a Rules block to read rules from a separate file. Like the LoadRule directive, wildcards are supported.

Optional directives

LockConfig

If this boolean directive is set to TRUE, NXLog Agent will lock the Audit system configuration after the rules have been set. It will not be possible to modify the Audit configuration until after a reboot. The default is FALSE: the Audit configuration will not be locked.

ResolveValues

This boolean directive, when set to TRUE, enables name resolution for the following fields: $arch, $auid, $cmd, $egid, $euid, $fsgid, $fsuid, $gid, $mode, $new_gid, $oauid, $obj_gid, $obj_uid, $ogid, $ouid, $sauid, $sgid, $suid, $syscall and $uid. These fields will be converted to human-readable strings, similarly to how the ausearch tool resolves them. The xm_resolver module must be loaded in order for this to work. The default value for this directive is FALSE, meaning that fields will not be resolved.

Fields

The following fields are used by im_linuxaudit.

$raw_event (type: string): A list of event fields in key-value pairs.

$a0 (type: string): The first four arguments of the system call, encoded in hexadecimal notation.

$a1 (type: string): The second four arguments of the system call, encoded in hexadecimal notation.

$a2 (type: string): The third four arguments of the system call, encoded in hexadecimal notation.

$a3 (type: string): The fourth four arguments of the system call, encoded in hexadecimal notation.

$acct (type: string): A user’s account name.

$addr (type: string): The IPv4 or IPv6 address. This field usually follows a hostname field and contains the address the host name resolves to.

$arch (type: string): Information about the CPU architecture of the system, encoded in hexadecimal notation.

$auid (type: integer): The Audit user ID. This ID is assigned to a user upon login and is inherited by every process even when the user’s identity changes (for example, by switching user accounts with su - john.

$cap_fi (type: string): Data related to the setting of an inherited file system-based capability.

$cap_fp (type: string): Data related to the setting of a permitted file system-based capability.

$cap_pe (type: string): Data related to the setting of an effective process-based capability.

$cap_pi (type: string): Data related to the setting of an inherited process-based capability.

$cap_pp (type: string): Data related to the setting of a permitted process-based capability.

$capability (type: integer): The number of bits that were used to set a particular Linux capability. For more information on Linux capabilities, see the capabilities(7) man page.

$cgroup (type: string): The path to the cgroup that contains the process at the time the Audit event was generated.

$cmd (type: string): The entire command line that is executed. This is useful in case of shell interpreters where the exe field records, for example, /bin/bash as the shell interpreter and the cmd field records the rest of the command line that is executed, for example helloworld.sh --help.

$comm (type: string): The command that is executed. This is useful in case of shell interpreters where the exe field records, for example, /bin/bash as the shell interpreter and the comm field records the name of the script that is executed, for example helloworld.sh.

$cwd (type: string): The path to the directory in which a system call was invoked.

$data (type: string): Data associated with TTY records.

$dev (type: string): The minor and major ID of the device that contains the file or directory recorded in an event.

$devmajor (type: string): The major device ID.

$devminor (type: string): The minor device ID.

$egid (type: integer): The effective group ID of the user who started the analyzed process.

$euid (type: integer): The effective user ID of the user who started the analyzed process.

$exe (type: string): The path to the executable that was used to invoke the analyzed process.

$exit (type: integer): The exit code returned by a system call. This value varies by system call. You can interpret the value to its human-readable equivalent with the following command: ausearch --interpret --exit exit_code

$family (type: string): The type of address protocol that was used, either IPv4 or IPv6.

$filetype (type: string): The type of the file.

$flags (type: integer): The file system name flags.

$fsgid (type: integer): The file system group ID of the user who started the analyzed process.

$fsuid (type: integer): The file system user ID of the user who started the analyzed process.

$gid (type: integer): The group ID.

$hostname (type: string): The host name.

$icmptype (type: string): The type of a Internet Control Message Protocol (ICMP) package that is received. Audit messages containing this field are usually generated by iptables.

$id (type: integer): The user ID of an account that was changed.

$inode (type: integer): The inode number associated with the file or directory recorded in an Audit event.

$inode_gid (type: integer): The group ID of the inode’s owner.

$inode_uid (type: integer): The user ID of the inode’s owner.

$items (type: integer): The number of path records that are attached to this record.

$key (type: string): The user defined string associated with a rule that generated a particular event in the Audit log.

$list (type: string): The Audit rule list ID. The following is a list of known IDs: 0 — user 1 — task 4 — exit 5 — exclude.

$mode (type: string): The file or directory permissions, encoded in numerical notation.

$msg (type: string): A time stamp and a unique ID of a record, or various event-specific <name>=<value> pairs provided by the kernel or user-space applications.

$msgtype (type: string): The message type that is returned in case of a user-based AVC denial. The message type is determined by D-Bus.

$name (type: string): The full path of the file or directory that was passed to the system call as an argument.

$new-disc (type: string): The name of a new disk resource that is assigned to a virtual machine.

$new-mem (type: integer): The amount of a new memory resource that is assigned to a virtual machine.

$new-net (type: string): The MAC address of a new network interface resource that is assigned to a virtual machine.

$new-vcpu (type: integer): The number of a new virtual CPU resource that is assigned to a virtual machine.

$new_gid (type: integer): A group ID that is assigned to a user.

$oauid (type: integer): The user ID of the user that has logged in to access the system (as opposed to, for example, using su) and has started the target process. This field is exclusive to the record of type OBJ_PID.

$obj (type: string): The SELinux context of an object. An object can be a file, a directory, a socket, or anything that is receiving the action of a subject.

$obj_gid (type: integer): The group ID of an object.

$obj_lev_high (type: string): The high SELinux level of an object.

$obj_lev_low (type: string): The low SELinux level of an object.

$obj_role (type: string): The SELinux role of an object.

$obj_uid (type: integer): The UID of an object.

$obj_user (type: string): The user that is associated with an object.

$ocomm (type: string): The command that was used to start the target process.This field is exclusive to the record of type OBJ_PID.

$ogid (type: integer): The object owner’s group ID.

$old-disk (type: string): The name of an old disk resource when a new disk resource is assigned to a virtual machine.

$old-mem (type: integer): The amount of an old memory resource when a new amount of memory is assigned to a virtual machine.

$old-net (type: string): The MAC address of an old network interface resource when a new network interface is assigned to a virtual machine.

$old-vcpu (type: integer): The number of an old virtual CPU resource when a new virtual CPU is assigned to a virtual machine.

$old_prom (type: integer): The previous value of the network promiscuity flag.

$opid (type: integer): The process ID of the target process. This field is exclusive to the record of type OBJ_PID.

$oses (type: string): The session ID of the target process. This field is exclusive to the record of type OBJ_PID.

$ouid (type: integer): Records the real user ID of the user who started the target process.

$path (type: string): The full path of the file or directory that was passed to the system call as an argument in case of AVC-related Audit events

$perm (type: string): The file permission that was used to generate an event (that is, read, write, execute, or attribute change)

$pid (type: integer): The pid field semantics depend on the origin of the value in this field. In fields generated from user space, this field holds a process ID. In fields generated by the kernel, this field holds a thread ID. The thread ID is equal to process ID for single-threaded processes. Note that the value of this thread ID is different from the values of pthread_t IDs used in user space. For more information, see the gettid(2) man page.

$ppid (type: integer): The Parent Process ID (PID).

$prom (type: string): The network promiscuity flag.

$proto (type: string): The networking protocol that was used. This field is specific to Audit events generated by iptables.

$res (type: string): The result of the operation that triggered the Audit event.

$result (type: string): The result of the operation that triggered the Audit event.

$saddr (type: string): The socket address.

$sauid (type: integer): The sender Audit login user ID. This ID is provided by D-Bus as the kernel is unable to see which user is sending the original auid.

$ses (type: string): The session ID of the session from which the analyzed process was invoked.

$sgid (type: integer): The set group ID of the user who started the analyzed process.

$sig (type: string): The number of a signal that causes a program to end abnormally. Usually, this is a sign of a system intrusion.

$subj (type: string): The SELinux context of a subject. A subject can be a process, a user, or anything that is acting upon an object.

$subj_clr (type: string): The SELinux clearance of a subject.

$subj_role (type: string): The SELinux role of a subject.

$subj_sen (type: string): The SELinux sensitivity of a subject.

$subj_user (type: string): The user that is associated with a subject.

$success (type: string): Whether a system call was successful or failed.

$suid (type: integer): The set user ID of the user who started the analyzed process.

$syscall (type: string): The type of the system call that was sent to the kernel.

$terminal (type: string): The terminal name (without /dev/).

$tty (type: string): The name of the controlling terminal. The value (none) is used if the process has no controlling terminal.

$uid (type: integer): the real user ID of the user who started the analyzed process.

$vm (type: string): The name of a virtual machine from which the Audit event originated.

Examples

Example 1. Collecting audit logs with LoadRule directive

This configuration uses a set of external rule files to configure the Audit system.

nxlog.conf

<Input audit>
    Module      im_linuxaudit
    FlowControl FALSE
    LoadRule    'im_linuxaudit_*.rules'
</Input>

Example 2. Collecting audit logs with a rules block

This configuration lists the rules inside the NXLog Agent configuration file instead of using a separate Audit rules file.

nxlog.conf

<Input audit>
    Module      im_linuxaudit
    FlowControl FALSE
    <Rules>
        # Watch /etc/passwd for modifications and tag with 'passwd'
        -w /etc/passwd -p wa -k passwd
    </Rules>
</Input>