Re: auditd not triggering ANOM_ROOT_TRANS record
On Oct 25, 2016 06:42, "teroz" <terence.namusonge(a)gmail.com> wrote:
Hey William
exploit is run as a normal user and privilege escalates to a root shell
Look under the covers. Dirty cow allows arbitrary file modification, so
somewhere it's likely executing some setuid root thing that it modifies.
Take a peak with strace.
https://www.google.com/amp/www.theregister.co.uk/AMP/2016/10/21/linux_pri...
On Tue, 25 Oct 2016 at 15:09 William Roberts
<bill.c.roberts(a)gmail.com>
wrote:
>
> On Oct 25, 2016 05:12, "teroz" <terence.namusonge(a)gmail.com> wrote:
> >
> > I used one of the dirtycow root exploits on Fedora24 configured
with
30-pci-dss-v31.rules. I was expecting an ANOM_ROOT_TRANS record but
didn't get one. What triggers an ANOM_ROOT_TRANS record? What then is the
best way to trivially audit for a successful privilege escalation?
> >
>
> I would imagine that if it's hijacking an already root or setuid binary,
you won't see anything. As far as that record goes, I have no idea, I'll
let an auditing expert answer that question.
> >
> >
> >
>
>
> >
> > --
> > Linux-audit mailing list
> > Linux-audit(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/linux-audit
Attachments:
- attachment.html (text/html — 1.9 KB)