Better security auditing with Auditd and the Integrity Measurement Architecture
Gotcha

© Photo by Kit Ishimatsu on Unsplash
The Integrity Measurement Architecture adds important details to your audit logs, making it easier to track an intruder's footprints.
Sometimes event logs are not enough, and you need to supply your security systems with something more. For instance, you might want to improve the detection of anomalies or facilitate the hunt for an intruder on your network. Many commercial solutions are available for file integrity monitoring in Linux. However, some budgets don't allow for a large investment. The good news is that Linux systems have a great selection of open source tools for securing systems, and these tools provide a means for maintaining file integrity at low cost. The Integrity Measurement Architecture comes in handy.
Integrity Measurement Architecture (IMA) [1] is a component of the Linux kernel's integrity subsystem (see the "Components of the Integrity Subsystem" box.) IMA is responsible for calculating hashes of files before loading them, and it supports reporting on the hashes. The integrity subsystem also consists of an Extended Verification Module (EVM) that detects tampering with offline security attribute extensions (e.g., SELinux), which are the basis for clearance decisions of the Linux Security Modules (LSM) framework.
Components of the Integrity Subsystem
Components of the Linux integrity subsystem include:
- IMA-measurement – part of the integrity architecture based on the open standards of the Trusted Computing Group, including TPM, Trusted Boot, Trusted Software Stack (TSS), Trusted Network Connect (TNC), and Platform Trust Services (PTS)
- IMA-appraisal – a component that extends the concept of "secure boot," checking file integrity before transferring control or allowing access to a file by the operating system
- IMA-audit – a component that contains hashes of files in the system audit logs that can be used to extend the system security analysis
The IMA measurement subsystem was added in Linux 2.6.30. Appraisal came later, in Linux 3.7.
What Is IMA?
The main purpose of IMA is to detect if files have been accidentally or intentionally changed, evaluate the measurement of a file against a value stored as an extension attribute, and enforce the integrity of local files. These objectives are complemented by Mandatory Access Control (MAC) protections provided by LSM modules such as SELinux and Smack.
To ensure file integrity, IMA can work with the Trusted Platform Module (TPM) chip [2] to protect the collected hashes from tampering.
IMA provides the following functions:
- Collect – measure a file before it is accessed.
- Store – add the measurement to a kernel resident list, and if a hardware TPM is present, extend the IMA PCR.
- Attest – use the TPM (if it is present) to sign the IMA PCR value, allowing a remote validation of the measurement list.
- Appraise – enforce local validation of a measurement against a known value stored in an extended attribute of the file.
- Protect – protect a file's security/extended attributes (including appraisal hash) against offline attack.
- Audit – audit the file hashes.
Enabling IMA
The first step for enabling IMA is to open and replace some lines in the kernel configuration file. Listing 1 shows an example of the changes for kernel version 4.15.0.
Listing 1
Enabling IMA
$ vi /boot/config-4.15.0-126-generic CONFIG_INTEGRITY=y CONFIG_IMA=y CONFIG_IMA_MEASURE_PCR_IDX=10 CONFIG_IMA_LSM_RULES=y CONFIG_INTEGRITY_SIGNATURE=y CONFIG_IMA_APPRAISE=y -- # Since 4.13 IMA_APPRAISE_BOOTPARAM=y --
The next step is to update the bootloader configuration. Add the following line to the /etc/default/grub
file:
GRUB_CMDLINE_LINUX="ima_tcb lsm=integrity ima_appraise=enforce ima_policy=tcb ima_policy=appraise_tcb ima_hash=sha256"
lsm=integrity
enables integration with LSM, and ima_appraise = enforce
causes IMA to evaluate files according to policy.
Update Grub with:
$ sudo update-grub
The integrity log registered by IMA is located in the directory /sys/kernel/security/ima/ascii_runtime_measurements
.
The next task is to create an IMA Policy configuration file in the /etc/ima
directory:
$ vi /etc/ima/policy.conf
Add the following line:
audit func=BPRM_CHECK mask=MAY_EXEC
The rules you define in the policy file apply to auditing all executable files.
To load an IMA policy, enter:
$ cat /etc/ima/policy.conf > /sys/kernel/security/ima/policy
Some policies might be too general for the system. Therefore, in the future, you should adapt according to your needs.
Restart for the changes to take effect.
Auditd
Auditd is a userspace component that receives and logs information from the underlying Linux auditing system. The auditd userspace tool is a good example of an application that uses information from IMA.
The first step is to install the necessary packages. In Ubuntu:
$ sudo apt-get install auditd audispd-plugins
Or in Centos:
$ sudo yum install audit audit-libs
Once the packages are installed, you can start and enable the service with:
$ sudo systemctl start auditd $ sudo systemctl enable auditd
All auditd events are located in:
/var/log/audit/audit.log
Each entry in the log contains a collection of values that will provide a roadmap for auditing the event. For the INTEGRITY_RULE
policy, the log includes an SHA-256 hash to establish the integrity of the file, along with other settings (see Listing 2).
Listing 2
Integrity Rule Event
type=INTEGRITY_RULE msg=audit(1619631954.633.430): file="/root/script.sh" hash="sha256:7fa8f6dae6e81358308eee2a7a77a7d71d40e8f9cadbb3e266ea39371041f8fd" ppid=1897 pid=2007 auid=1000 uid=0 gid=0 euid=0
The auditd syntax is as follows:
-w path-to-file -p permissions (r,w,x,a) -k keyname
where -w
is the path to the file or directory. -p
describes the permission access type that a file system watch will trigger on (r
=read, w=write, x
=execute, and a
=attribute). -k
is the "keyname" switch, which describes what the alert is about, thus making it easier to interpret and filter the logs. The key value can be searched from SIEM or Log Management systems, so that no matter which rule triggered an event, you can find the results.
Auditd lets you create and customize rules. To make your own rules, you should add them to the file /etc/audit/rules.d/audit.rules
or use the auditctl
command.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Direct Download
Read full article as PDF:
Price $2.95
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Find SysAdmin Jobs
News
-
LibreOffice 7.5 has Arrived and is Loaded with New Features and Improvements
The favorite office suite of the Linux community has a new release that includes some visual refreshing and new features across all modules.
-
The Next Major Release of Elementary OS Has Arrived
It's been over a year since the developers of elementary OS released version 6.1 (Jólnir) but they've finally made their latest release (Horus) available with a renewed focus on the user.
-
KDE Plasma 5.27 Beta Is Ready for Testing
The latest beta iteration of the KDE Plasma desktop is now available and includes some important additions and fixes.
-
Netrunner OS 23 Is Now Available
The latest version of this Linux distribution is now based on Debian Bullseye and is ready for installation and finally hits the KDE 5.20 branch of the desktop.
-
New Linux Distribution Built for Gamers
With a Gnome desktop that offers different layouts and a custom kernel, PikaOS is a great option for gamers of all types.
-
System76 Beefs Up Popular Pangolin Laptop
The darling of open-source-powered laptops and desktops will soon drop a new AMD Ryzen 7-powered version of their popular Pangolin laptop.
-
Nobara Project Is a Modified Version of Fedora with User-Friendly Fixes
If you're looking for a version of Fedora that includes third-party and proprietary packages, look no further than the Nobara Project.
-
Gnome 44 Now Has a Release Date
Gnome 44 will be officially released on March 22, 2023.
-
Nitrux 2.6 Available with Kernel 6.1 and a Major Change
The developers of Nitrux have officially released version 2.6 of their Linux distribution with plenty of new features to excite users.
-
Vanilla OS Initial Release Is Now Available
A stock GNOME experience with on-demand immutability finally sees its first production release.