Apparmor #243
Apparmor #243
Conversation
basically ignore things. The IDs for the rules are in the user range, but that can change later. Sample log message is from RealRancor on github ossec#234. Hopefully he can help expand the rules.
determining how malicious some action is. Add arule to alert on DENIED messages. The examples provided by @RealRancor illustrate an issue. The original examples that were provided were in a syslog format with "kernel" as the program_name. This made them identify as iptables log messages. The DENIED examples did not have the syslog header, and identified as auditd log messages. This work should probably duplicate what was already done for auditd.
DENIED log samples. I don't know how much value something like this really has, but I don't have a lot of experience with apparmor. On another note, but British may be right. Armour feels more right than armor.
|
@RealRancor any updates? |
|
I like it and acts a great starting point. I would love unit tests if you have time. |
|
@ddpbsd Sorry for the long delay of the feedback The STATUS and ALLOWED message are successfully ignored by the new rules. Unfortunately i don't have live data of DENIED messages at the moment. Tomorrow i will have a look at some other systems running apparmor to see if i can find some of them on those systems. |
Some quick decoder/rules for apparmor. Log samples provided by @RealRancor
|
Only found this repeating log entry on one of my other systems running apparmor:
which is also catched by the initial rule "400003". Its probably not needed to add an extra sub-rule for this "open" operation. |
|
On Mon, Jul 14, 2014 at 7:24 AM, RealRancor [email protected] wrote:
Awesome, thanks for looking!
|
Some quick decoder/rules for apparmor. Log samples provided by @RealRancor