Novell LINUX ENTERPRISE SERVER 11 - SECURITY Manual

Also see for LINUX ENTERPRISE DESKTOP 11: Installation Administration guide

Contents

Novell LINUX ENTERPRISE SERVER 11 - SECURITY Manual Manual pdf 444 page image

32.5 Monitoring MiscellaneousSystem CallsAs well as auditing file system related system calls, as described in Section 32.3,“Monitoring File System Objects” (page 426), you can also track various other systemcalls. Tracking task creation helps you understand your applications' behavior. Auditingthe umask system call lets you track how processes modify permissions. Tracking anyattempts to change the system time helps you identify anyone or any process trying tomanipulate the system time.❶-a entry,always -S clone -S fork -S vfork## For ia64 architecture, disable fork and vfork rules above, and## enable the following:#-a entry,always -S clone2❷-a entry,always -S umask❸-a entry,always -S adjtimex -S settimeofday❶ Track task creation. To enable task tracking on the ia64 architecture, commentthe first rule and enable the second one.❷ Add an audit context to the umask system call.❸ Track attempts to change the system time. adjtimex can be used to skew thetime. settimeofday sets the absolute time.32.6 Filtering System Call ArgumentsIn addition to the system call auditing introduced in Section 32.3, “Monitoring FileSystem Objects” (page 426) and Section 32.5, “Monitoring Miscellaneous System Calls”(page 430), you can track application behavior to an even higher degree. Applying filtershelps you focus audit on areas of primary interest to you. This section introduces filteringsystem call arguments for nonmultiplexed system calls like access and for multiplexedones like socketcall or ipc. Whether system calls are multiplexed depends on the hard-ware architecture used. Both socketcall and ipc are not multiplexed on 64-bit architec-tures, such as x86_64 and ia64.430 Security Guide