Better security auditing with Auditd and the Integrity Measurement Architecture
Gotcha
The Integrity Measurement Architecture adds important details to your audit logs, making it easier to track an intruder's footprints.
Sometimes event logs are not enough, and you need to supply your security systems with something more. For instance, you might want to improve the detection of anomalies or facilitate the hunt for an intruder on your network. Many commercial solutions are available for file integrity monitoring in Linux. However, some budgets don't allow for a large investment. The good news is that Linux systems have a great selection of open source tools for securing systems, and these tools provide a means for maintaining file integrity at low cost. The Integrity Measurement Architecture comes in handy.
Integrity Measurement Architecture (IMA) [1] is a component of the Linux kernel's integrity subsystem (see the "Components of the Integrity Subsystem" box.) IMA is responsible for calculating hashes of files before loading them, and it supports reporting on the hashes. The integrity subsystem also consists of an Extended Verification Module (EVM) that detects tampering with offline security attribute extensions (e.g., SELinux), which are the basis for clearance decisions of the Linux Security Modules (LSM) framework.
Components of the Integrity Subsystem
Components of the Linux integrity subsystem include:
- IMA-measurement – part of the integrity architecture based on the open standards of the Trusted Computing Group, including TPM, Trusted Boot, Trusted Software Stack (TSS), Trusted Network Connect (TNC), and Platform Trust Services (PTS)
- IMA-appraisal – a component that extends the concept of "secure boot," checking file integrity before transferring control or allowing access to a file by the operating system
- IMA-audit – a component that contains hashes of files in the system audit logs that can be used to extend the system security analysis
The IMA measurement subsystem was added in Linux 2.6.30. Appraisal came later, in Linux 3.7.
What Is IMA?
The main purpose of IMA is to detect if files have been accidentally or intentionally changed, evaluate the measurement of a file against a value stored as an extension attribute, and enforce the integrity of local files. These objectives are complemented by Mandatory Access Control (MAC) protections provided by LSM modules such as SELinux and Smack.
To ensure file integrity, IMA can work with the Trusted Platform Module (TPM) chip [2] to protect the collected hashes from tampering.
IMA provides the following functions:
- Collect – measure a file before it is accessed.
- Store – add the measurement to a kernel resident list, and if a hardware TPM is present, extend the IMA PCR.
- Attest – use the TPM (if it is present) to sign the IMA PCR value, allowing a remote validation of the measurement list.
- Appraise – enforce local validation of a measurement against a known value stored in an extended attribute of the file.
- Protect – protect a file's security/extended attributes (including appraisal hash) against offline attack.
- Audit – audit the file hashes.
Enabling IMA
The first step for enabling IMA is to open and replace some lines in the kernel configuration file. Listing 1 shows an example of the changes for kernel version 4.15.0.
Listing 1
Enabling IMA
$ vi /boot/config-4.15.0-126-generic CONFIG_INTEGRITY=y CONFIG_IMA=y CONFIG_IMA_MEASURE_PCR_IDX=10 CONFIG_IMA_LSM_RULES=y CONFIG_INTEGRITY_SIGNATURE=y CONFIG_IMA_APPRAISE=y -- # Since 4.13 IMA_APPRAISE_BOOTPARAM=y --
The next step is to update the bootloader configuration. Add the following line to the /etc/default/grub
file:
GRUB_CMDLINE_LINUX="ima_tcb lsm=integrity ima_appraise=enforce ima_policy=tcb ima_policy=appraise_tcb ima_hash=sha256"
lsm=integrity
enables integration with LSM, and ima_appraise = enforce
causes IMA to evaluate files according to policy.
Update Grub with:
$ sudo update-grub
The integrity log registered by IMA is located in the directory /sys/kernel/security/ima/ascii_runtime_measurements
.
The next task is to create an IMA Policy configuration file in the /etc/ima
directory:
$ vi /etc/ima/policy.conf
Add the following line:
audit func=BPRM_CHECK mask=MAY_EXEC
The rules you define in the policy file apply to auditing all executable files.
To load an IMA policy, enter:
$ cat /etc/ima/policy.conf > /sys/kernel/security/ima/policy
Some policies might be too general for the system. Therefore, in the future, you should adapt according to your needs.
Restart for the changes to take effect.
Auditd
Auditd is a userspace component that receives and logs information from the underlying Linux auditing system. The auditd userspace tool is a good example of an application that uses information from IMA.
The first step is to install the necessary packages. In Ubuntu:
$ sudo apt-get install auditd audispd-plugins
Or in Centos:
$ sudo yum install audit audit-libs
Once the packages are installed, you can start and enable the service with:
$ sudo systemctl start auditd $ sudo systemctl enable auditd
All auditd events are located in:
/var/log/audit/audit.log
Each entry in the log contains a collection of values that will provide a roadmap for auditing the event. For the INTEGRITY_RULE
policy, the log includes an SHA-256 hash to establish the integrity of the file, along with other settings (see Listing 2).
Listing 2
Integrity Rule Event
type=INTEGRITY_RULE msg=audit(1619631954.633.430): file="/root/script.sh" hash="sha256:7fa8f6dae6e81358308eee2a7a77a7d71d40e8f9cadbb3e266ea39371041f8fd" ppid=1897 pid=2007 auid=1000 uid=0 gid=0 euid=0
The auditd syntax is as follows:
-w path-to-file -p permissions (r,w,x,a) -k keyname
where -w
is the path to the file or directory. -p
describes the permission access type that a file system watch will trigger on (r
=read, w=write, x
=execute, and a
=attribute). -k
is the "keyname" switch, which describes what the alert is about, thus making it easier to interpret and filter the logs. The key value can be searched from SIEM or Log Management systems, so that no matter which rule triggered an event, you can find the results.
Auditd lets you create and customize rules. To make your own rules, you should add them to the file /etc/audit/rules.d/audit.rules
or use the auditctl
command.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
TUXEDO Computers Unveils Linux Laptop Featuring AMD Ryzen CPU
This latest release is the first laptop to include the new CPU from Ryzen and Linux preinstalled.
-
XZ Gets the All-Clear
The back door xz vulnerability has been officially reverted for Fedora 40 and versions 38 and 39 were never affected.
-
Canonical Collaborates with Qualcomm on New Venture
This new joint effort is geared toward bringing Ubuntu and Ubuntu Core to Qualcomm-powered devices.
-
Kodi 21.0 Open-Source Entertainment Hub Released
After a year of development, the award-winning Kodi cross-platform, media center software is now available with many new additions and improvements.
-
Linux Usage Increases in Two Key Areas
If market share is your thing, you'll be happy to know that Linux is on the rise in two areas that, if they keep climbing, could have serious meaning for Linux's future.
-
Vulnerability Discovered in xz Libraries
An urgent alert for Fedora 40 has been posted and users should pay attention.
-
Canonical Bumps LTS Support to 12 years
If you're worried that your Ubuntu LTS release won't be supported long enough to last, Canonical has a surprise for you in the form of 12 years of security coverage.
-
Fedora 40 Beta Released Soon
With the official release of Fedora 40 coming in April, it's almost time to download the beta and see what's new.
-
New Pentesting Distribution to Compete with Kali Linux
SnoopGod is now available for your testing needs
-
Juno Computers Launches Another Linux Laptop
If you're looking for a powerhouse laptop that runs Ubuntu, the Juno Computers Neptune 17 v6 should be on your radar.