31 lines
1 KiB
Text
31 lines
1 KiB
Text
# CNSPEC: Ensure events that modify user/group information are collected
|
|
|
|
-w /etc/group -p wa -k identity
|
|
-w /etc/passwd -p wa -k identity
|
|
-w /etc/gshadow -p wa -k identity
|
|
-w /etc/shadow -p wa -k identity
|
|
-w /etc/security/opasswd -p wa -k identity
|
|
|
|
# CNSPEC: Ensure changes to system administration scope (sudoers) is collected
|
|
|
|
-w /etc/sudoers -p wa -k scope
|
|
-w /etc/sudoers.d -p wa -k scope
|
|
|
|
# CNSPEC: Ensure events that modify the system's Mandatory Access Controls are collected
|
|
|
|
-w /etc/apparmor/ -p wa -k MAC-policy
|
|
-w /etc/apparmor.d/ -p wa -k MAC-policy
|
|
|
|
# CNSPEC: Ensure session initiation information is collected
|
|
|
|
-w /var/run/utmp -p wa -k session
|
|
-w /var/log/wtmp -p wa -k logins
|
|
-w /var/log/btmp -p wa -k logins
|
|
|
|
# CNSPEC: Ensure kernel module loading and unloading is collected
|
|
|
|
-w /sbin/insmod -p x -k modules
|
|
-w /sbin/rmmod -p x -k modules
|
|
-w /sbin/modprobe -p x -k modules
|
|
# Disabled as of https://gitlab.archlinux.org/archlinux/packaging/packages/audit/-/issues/2
|
|
#-a always,exit -F arch=b64 -S init_module -S delete_module -k modules
|