search

tom-krieger / cis_security_hardening

Define a complete security baseline and monitor the baseline's rules. The definition of the baseline should be done in Hiera. The purpose of the module is to give the ability to setup a complete security baseline which not necessarily have to stick to industry security guides like the CIS benchmarks.
Apache License 2.0
15 stars 10 forks source link

auditd_time_change clock_settime failed on RHEL 8 #63

Closed warrenbel closed 2 months ago

warrenbel commented 1 year ago

I am getting a fail on clock_settime

I think the missing is the "-F a0=0x0"

-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key= -a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=

tom-krieger commented 12 months ago

Can you please be a bit more precise? I can not see any issue with the auditd rules on Rhel 8.

According to the CIS Benchmark for RHEL 8 v 2.0.0 the following rules should be added: -a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime -k time- change -a always,exit -F arch=b32 -S adjtimex,settimeofday,clock_settime -k time- change -w /etc/localtime -p wa -k time-change

And that's what the module does.

From where did you get the "-F a0=0x0" information?

warrenbel commented 12 months ago

okay right. CIS RHEL8 v2.0.0 document does not have the "-F a0=0x0".

I am using the OpenSCAP with profile CIS RHEL8 v2.0.0, released 2022-02-23

it should be the same version, I am not sure why OpenSCAP has additional filter. I will try reaching out to them.

tom-krieger commented 11 months ago

Please keep me informed. I'm curious about results. I leave this one open for the moment

warrenbel commented 11 months ago

there is no clear solution yet. CIS is releasing CIS v3.0,0 Benchmark But they said they're still expecting the following rules:

-a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime -k time-change -a always,exit -F arch=b32 -S adjtimex,settimeofday,clock_settime -k time-change -w /etc/localtime -p wa -k time-change

RedHat however is recommending to add -F a0=0x0

tom-krieger commented 4 months ago

Is there any news in that or can we close this issue?

tom-krieger commented 2 months ago

As there is no new information I close this now.