search

Neo23x0 / auditd

Best Practice Auditd Configuration
Apache License 2.0
1.5k stars 261 forks source link

log bypass #148

Open tititototutu opened 4 months ago

tititototutu commented 4 months ago

Hello,

Thank you very much for your work!

A Log bypass is possible by executing the binary flagged with "ld-linux.so".

/usr/bin/dpkg # This is logged
/lib64/ld-linux-x86-64.so.2 /usr/bin/dpkg # Not logged
Pierre-Gronau-ndaal commented 3 months ago

What about adding

-a always,exit -F path=/lib64/ld-linux-x86-64.so.2 -F perm=x -F auid!=unset -k ld_execution