Re: Sycall Rules vs Watch Rules

--===============4412796946518693254==
Content-Type: multipart/alternative; boundary="000000000000bbfee006055f8333"

--000000000000bbfee006055f8333
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

Just wanted to follow up wrt the previous findings and experiments and what
some of your thoughts are on the suggested optimizations.

Regards
Ali

On Tue, Sep 12, 2023 at 4:20 PM Amjad Gabbar <[email protected]>
wrote:

> So,
>
> Based on this and some experiments I have been performing, I would sugges=
t
> changing how a lot of the FileSystem rules are written and illustrated.
> Ex -
> https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-d=
ss-v31.rules#L34-L35
>
> The rule in the repository is
> -a always,exit -F path=3D/etc/sudoers -F perm=3Dwa -F
> key=3D10.2.2-priv-config-changes
>
> My suggestion is to instead change the rule based on the permissions
> defined. The above rule would change to the following based on the kernel
> being used.
> -a always,exit -S <list of syscalls in audit_write.h and audit_read.h
> +open,openat> -F path=3D/etc/sudoers -F perm=3Dwa -F
> key=3D10.2.2-priv-config-changes
>
> This is higher performance because we are limiting the syscalls instead o=
f
> making use of -S all which has more paths of evaluation for each and ever=
y
> syscall.
>
> Same thing for watches. Watches are inherently -S all rules which are ver=
y
> performance intensive.
>
> https://github.com/linux-audit/audit-userspace/blob/1482cec74f2d9472f81dd=
4f0533484bd0c26decd/lib/libaudit.c#L805
>
> Ideally we should limit the syscalls based on the permissions being used.
>
> I have implemented the same in my environment rules and have noticed a
> massive performance difference with no difference in the events being
> logged since we anyways filter eventually based on the permissions.
>
> Let me know what you all think.
>
> Ali Adnan.
>
>
>
>
>
> On Wed, Sep 6, 2023 at 2:58 PM Richard Guy Briggs <[email protected]> wrote:
>
>> On 2023-09-06 10:56, Amjad Gabbar wrote:
>> > Hi,
>> >
>> > I have done some analysis and digging into how both the watch rules an=
d
>> > syscall rules are translated.
>> >
>> > From my understanding, in terms of logging, both the below rules are
>> > similar. There is no difference in either of the rules.
>> >
>> > 1. -w /etc -p wa -k ETC_WATCH
>>
>> They are similar in this case.
>> -w behaves differently depending on the existance of the watched entity
>> and the presence of a trailing "/".  This is why the form above is
>> deprecated.
>>
>> > 2. -a always,exit -F arch=3Db64 -S <all syscalls part of the write and
>> attr
>> > classes> -F dir=3D/etc  -F perm=3Dwa -k ETC_WATCH
>> >
>> > The write and attr classes consist of syscalls in
>> > =E2=80=9Cinclude/asm-generic/audit_*.h=E2=80=9C.
>> >
>> >  The perm flag is needed in the second case for including open/openat
>> > syscalls which are not a part of the write and attr syscall list.
>> >
>> > I'd like to verify if what I mentioned earlier is accurate, and I have
>> an
>> > additional point but depends on whether this is accurate.
>> >
>> > Ali
>>
>> - RGB
>>
>> --
>> Richard Guy Briggs <[email protected]>
>> Sr. S/W Engineer, Kernel Security, Base Operating Systems
>> Remote, Ottawa, Red Hat Canada
>> Upstream IRC: SunRaycer
>> Voice: +1.613.860 2354 SMS: +1.613.518.6570
>>
>>

--000000000000bbfee006055f8333
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">Hi,</div><div dir=3D"auto"><br></div><div dir=3D"auto">Ju=
st wanted to follow up wrt the previous findings and experiments and what s=
ome of your thoughts are on the suggested optimizations.</div><div dir=3D"a=
uto"><br></div><div dir=3D"auto">Regards</div><div dir=3D"auto">Ali</div><d=
iv><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On =
Tue, Sep 12, 2023 at 4:20 PM Amjad Gabbar &lt;<a href=3D"mailto:amjadgabbar=
[email protected]">[email protected]</a>&gt; wrote:<br></div><blockquote c=
lass=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;=
padding-left:1ex"><div dir=3D"ltr"><div dir=3D"auto">So,</div><div dir=3D"a=
uto"><br></div><div dir=3D"auto">Based on this and some experiments I have =
been performing, I would suggest changing how a lot of the FileSystem rules=
 are written and illustrated.</div><div>Ex -=C2=A0<a href=3D"https://github=
.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules#L34=
-L35" target=3D"_blank">https://github.com/linux-audit/audit-userspace/blob=
/master/rules/30-pci-dss-v31.rules#L34-L35</a></div><div><br></div><div>The=
 rule in the repository is</div><div>-a always,exit -F path=3D/etc/sudoers =
-F perm=3Dwa -F key=3D10.2.2-priv-config-changes<br></div><div><br></div><d=
iv>My suggestion is to instead change the rule based on the permissions def=
ined. The above rule would change to the following=C2=A0based on the kernel=
 being used.</div><div>-a always,exit -S &lt;list of syscalls in audit_writ=
e.h and audit_read.h +open,openat&gt; -F path=3D/etc/sudoers -F perm=3Dwa -=
F key=3D10.2.2-priv-config-changes<br></div><div><br></div><div>This is hig=
her performance because we are limiting the syscalls instead of making use =
of -S all which has more paths of evaluation for each and every syscall.</d=
iv><div><br></div><div>Same thing for watches. Watches are inherently -S al=
l rules which are very performance=C2=A0intensive.</div><div><a href=3D"htt=
ps://github.com/linux-audit/audit-userspace/blob/1482cec74f2d9472f81dd4f053=
3484bd0c26decd/lib/libaudit.c#L805" target=3D"_blank">https://github.com/li=
nux-audit/audit-userspace/blob/1482cec74f2d9472f81dd4f0533484bd0c26decd/lib=
/libaudit.c#L805</a><br></div><div><br></div><div>Ideally we should limit t=
he syscalls based on the permissions being used.=C2=A0</div><div><br></div>=
<div>I have implemented the same in my environment rules and have noticed a=
 massive performance difference with no difference in the events being logg=
ed since we anyways filter eventually based on the permissions.</div><div><=
br></div><div>Let me know what you all think.</div><div><br></div><div>Ali =
Adnan.</div><div><br></div><div><br></div><div><br></div><div><br></div></d=
iv><div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr=
">On Wed, Sep 6, 2023 at 2:58 PM Richard Guy Briggs &lt;<a href=3D"mailto:r=
[email protected]" target=3D"_blank">[email protected]</a>&gt; wrote:<br></div><bl=
ockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-lef=
t:1px solid rgb(204,204,204);padding-left:1ex">On 2023-09-06 10:56, Amjad G=
abbar wrote:<br>
&gt; Hi,<br>
&gt; <br>
&gt; I have done some analysis and digging into how both the watch rules an=
d<br>
&gt; syscall rules are translated.<br>
&gt; <br>
&gt; From my understanding, in terms of logging, both the below rules are<b=
r>
&gt; similar. There is no difference in either of the rules.<br>
&gt; <br>
&gt; 1. -w /etc -p wa -k ETC_WATCH<br>
<br>
They are similar in this case.<br>
-w behaves differently depending on the existance of the watched entity<br>
and the presence of a trailing &quot;/&quot;.=C2=A0 This is why the form ab=
ove is<br>
deprecated.<br>
<br>
&gt; 2. -a always,exit -F arch=3Db64 -S &lt;all syscalls part of the write =
and attr<br>
&gt; classes&gt; -F dir=3D/etc=C2=A0 -F perm=3Dwa -k ETC_WATCH<br>
&gt; <br>
&gt; The write and attr classes consist of syscalls in<br>
&gt; =E2=80=9Cinclude/asm-generic/audit_*.h=E2=80=9C.<br>
&gt; <br>
&gt;=C2=A0 The perm flag is needed in the second case for including open/op=
enat<br>
&gt; syscalls which are not a part of the write and attr syscall list.<br>
&gt; <br>
&gt; I&#39;d like to verify if what I mentioned earlier is accurate, and I =
have an<br>
&gt; additional point but depends on whether this is accurate.<br>
&gt; <br>
&gt; Ali<br>
<br>
- RGB<br>
<br>
--<br>
Richard Guy Briggs &lt;<a href=3D"mailto:[email protected]" target=3D"_blank">=
[email protected]</a>&gt;<br>
Sr. S/W Engineer, Kernel Security, Base Operating Systems<br>
Remote, Ottawa, Red Hat Canada<br>
Upstream IRC: SunRaycer<br>
Voice: +1.613.860 2354 SMS: +1.613.518.6570<br>
<br>
</blockquote></div></div>
</blockquote></div></div>

--000000000000bbfee006055f8333--

--===============4412796946518693254==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
Linux-audit mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/linux-audit

--===============4412796946518693254==--