Novell LINUX ENTERPRISE DESKTOP 11, Руководство пользователя

Страница: 444 / 450

32.5 Monitoring Miscellaneous
System Calls
As well as auditing file system related system calls, as described in Section 32.3,
“Monitoring File System Objects” (page 426), you can also track various other system
calls. Tracking task creation helps you understand your applications' behavior. Auditing
the umask system call lets you track how processes modify permissions. Tracking any
attempts to change the system time helps you identify anyone or any process trying to
manipulate the system time.
❶
-a entry,always -S clone -S fork -S vfork
## For ia64 architecture, disable fork and vfork rules above, and
## enable the following:
#-a entry,always -S clone2
❷
-a entry,always -S umask
❸
-a entry,always -S adjtimex -S settimeofday
❶
Track task creation. To enable task tracking on the ia64 architecture, comment
the first rule and enable the second one.
❷
Add an audit context to the umask system call.
❸
Track attempts to change the system time.
adjtimex
can be used to skew the
time.
settimeofday
sets the absolute time.
32.6 Filtering System Call Arguments
In addition to the system call auditing introduced in Section 32.3, “Monitoring File
System Objects” (page 426) and Section 32.5, “Monitoring Miscellaneous System Calls”
(page 430), you can track application behavior to an even higher degree. Applying filters
helps you focus audit on areas of primary interest to you. This section introduces filtering
system call arguments for nonmultiplexed system calls like access and for multiplexed
ones like socketcall or ipc. Whether system calls are multiplexed depends on the hard-
ware architecture used. Both socketcall and ipc are not multiplexed on 64-bit architec-
tures, such as x86_64 and ia64.
430 Security Guide