Re: perhaps obvious question: auditd and setuid/setgid?

On Friday, September 04, 2015 10:54:47 AM John Jasen wrote: There are a couple ways to do this. One is using the find method. However, that does not take into account file system based capabilities. In the lab I taught this week, the rules generator also included this: filecap /bin 2>/dev/null | awk '{ printf "-a always,exit -F path=%s -F perm=x - F auid>=1000 -F auid!=4294967295 -F key=privileged\n", $1 }' >> priv.rules filecap /sbin 2>/dev/null | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=4294967295 -F key=privileged\n", $1 }' >> priv.rules filecap /usr/bin 2>/dev/null | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=4294967295 -F key=privileged\n", $1 }' >> priv.rules filecap /usr/sbin 2>/dev/null | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=4294967295 -F key=privileged\n", $1 }' >> priv.rules But, if all you want is setuid, then you can use a rule like this instead of file watches: -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -Steve