Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The power_abuse rule is broken after recent change #143

Closed
as9k1 opened this issue Apr 20, 2024 · 1 comment
Closed

The power_abuse rule is broken after recent change #143

as9k1 opened this issue Apr 20, 2024 · 1 comment

Comments

@as9k1
Copy link

as9k1 commented Apr 20, 2024

Hi,
The change made in this merged pull request (issue 125) in January unfortunately broke the power_abuse rule.

The rule does not work anymore because now it requires auid to be both 0 and >=1000 at the same time, which is impossible.

Merged version (since January):

## Privilege Abuse
### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir.
-a always,exit -F dir=/home -F auid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse

Original version (before January):

## Privilege Abuse
### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir.
-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse

How to fix:
My suggestion would be to revert back to the original version of the rule.

Tests done:
I tested the original and the merged version in an Ubuntu 22.04 VM. As expected, the merged version does not log the behavior, whereas the original version does.
Also, the error message mentioned by the original pull request author did not occur for me.

Neo23x0 added a commit that referenced this issue Apr 21, 2024
@Neo23x0
Copy link
Owner

Neo23x0 commented Apr 21, 2024

Thanks for texting it - I fixed that line

@Neo23x0 Neo23x0 closed this as completed Apr 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants