Skip to content

Commit 124df5f

Browse files
simongdaviessimongdavies
committed
update auditing
Signed-off-by: Simon Davies <[email protected]>
1 parent 213f7b6 commit 124df5f

File tree

1 file changed

+91
-19
lines changed

1 file changed

+91
-19
lines changed

‎.github/workflows/dep_rust.yml‎

Lines changed: 91 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -47,13 +47,33 @@ jobs:
4747
matrix.hypervisor == 'hyperv' && 'win2022' || matrix.hypervisor == 'hyperv-ws2025' && 'win2025' || matrix.hypervisor == 'mshv3' && 'azlinux3-mshv' || matrix.hypervisor,
4848
matrix.cpu)) }}
4949
steps:
50+
- name: Capture pre-workflow baseline
51+
if: runner.os == 'Linux'
52+
run: |
53+
echo "=== Pre-Workflow System State ==="
54+
echo "Timestamp: $(date)"
55+
echo ""
56+
echo "Initial device state:"
57+
ls -la /dev/kvm /dev/mshv 2>/dev/null || echo "Hypervisor devices don't exist yet"
58+
echo ""
59+
echo "Loaded kernel modules:"
60+
lsmod | grep -E "(kvm|mshv)" || echo "No KVM/MSHV modules loaded"
61+
echo ""
62+
echo "Current user and groups:"
63+
echo "User: $(whoami)"
64+
echo "Groups: $(groups)"
65+
echo ""
66+
echo "Initial audit log state:"
67+
sudo wc -l /var/log/audit/audit.log 2>/dev/null || echo "No audit log exists yet"
68+
5069
- uses: actions/checkout@v4
5170

52-
# Set up auditd monitoring for /dev/kvm permission changes
53-
- name: Setup auditd monitoring for hypervisor devices
71+
# Set up comprehensive auditd monitoring
72+
- name: Setup comprehensive auditd monitoring
5473
if: runner.os == 'Linux'
5574
run: |
56-
echo "Setting up auditd monitoring for hypervisor devices..."
75+
echo "Setting up comprehensive auditd monitoring for hypervisor devices..."
76+
5777
# Install auditd if not present
5878
if ! command -v auditctl &> /dev/null; then
5979
if command -v dnf &> /dev/null; then
@@ -66,13 +86,39 @@ jobs:
6686
# Start auditd service
6787
sudo systemctl start auditd || sudo service auditd start || echo "Failed to start auditd, continuing..."
6888
69-
# Add audit rules for /dev/kvm and /dev/mshv
70-
sudo auditctl -w /dev/kvm -p wa -k hypervisor_kvm || echo "Failed to add KVM audit rule"
71-
sudo auditctl -w /dev/mshv -p wa -k hypervisor_mshv || echo "Failed to add MSHV audit rule"
89+
# Clear existing rules to start fresh
90+
sudo auditctl -D || true
91+
92+
# Monitor the entire /dev directory for device creation/changes
93+
sudo auditctl -w /dev/ -p wa -k device_changes || echo "Failed to add /dev/ monitoring"
94+
95+
# Monitor specific hypervisor devices with all permissions
96+
sudo auditctl -w /dev/kvm -p rwxa -k hypervisor_kvm || echo "Failed to add KVM audit rule"
97+
sudo auditctl -w /dev/mshv -p rwxa -k hypervisor_mshv || echo "Failed to add MSHV audit rule"
98+
99+
# Monitor udev rules and execution that could affect device permissions
100+
sudo auditctl -w /etc/udev/rules.d/ -p wa -k udev_rules || echo "Failed to monitor udev rules"
101+
sudo auditctl -w /lib/udev/rules.d/ -p wa -k udev_rules || echo "Failed to monitor lib udev rules"
102+
sudo auditctl -w /usr/lib/udev/ -p x -k udev_execution || echo "Failed to monitor udev execution"
103+
104+
# Monitor system calls for permission changes
105+
sudo auditctl -a always,exit -S chmod,fchmod,chown,fchown,lchown -k permission_syscalls || echo "Failed to monitor permission syscalls"
72106
73-
# List current audit rules
74-
echo "Current audit rules:"
107+
# Monitor specific binaries that could change permissions
108+
sudo auditctl -w /usr/bin/chown -p x -k chown_exec || echo "Failed to monitor chown binary"
109+
sudo auditctl -w /usr/bin/chmod -p x -k chmod_exec || echo "Failed to monitor chmod binary"
110+
sudo auditctl -w /bin/chown -p x -k chown_exec || echo "Failed to monitor bin chown"
111+
sudo auditctl -w /bin/chmod -p x -k chmod_exec || echo "Failed to monitor bin chmod"
112+
113+
# Monitor systemd and related services that might affect devices
114+
sudo auditctl -w /usr/lib/systemd/ -p x -k systemd_execution || echo "Failed to monitor systemd"
115+
116+
echo ""
117+
echo "Active audit rules:"
75118
sudo auditctl -l || echo "Failed to list audit rules"
119+
echo ""
120+
echo "Auditd status:"
121+
sudo systemctl status auditd --no-pager || sudo service auditd status || echo "Failed to get auditd status"
76122
77123
# For rust-fmt
78124
- name: Set up nightly rust
@@ -230,21 +276,47 @@ jobs:
230276
echo "CPU virtualization features:"
231277
grep -E "(vmx|svm)" /proc/cpuinfo | head -5 || echo "No CPU virtualization features found"
232278
echo ""
233-
echo "=== Auditd Log Analysis ==="
279+
echo "=== Comprehensive Auditd Log Analysis ==="
280+
echo "Device creation/change events:"
281+
sudo ausearch -k device_changes -ts today 2>/dev/null || echo "No device change events found"
282+
echo ""
234283
echo "Hypervisor device audit events (KVM):"
235-
sudo ausearch -k hypervisor_kvm -ts today 2>/dev/null || echo "No KVM audit events found or ausearch failed"
284+
sudo ausearch -k hypervisor_kvm -ts today 2>/dev/null || echo "No KVM audit events found"
236285
echo ""
237286
echo "Hypervisor device audit events (MSHV):"
238-
sudo ausearch -k hypervisor_mshv -ts today 2>/dev/null || echo "No MSHV audit events found or ausearch failed"
287+
sudo ausearch -k hypervisor_mshv -ts today 2>/dev/null || echo "No MSHV audit events found"
288+
echo ""
289+
echo "Udev rules events:"
290+
sudo ausearch -k udev_rules -ts today 2>/dev/null || echo "No udev rules events found"
291+
echo ""
292+
echo "Udev execution events:"
293+
sudo ausearch -k udev_execution -ts today 2>/dev/null || echo "No udev execution events found"
294+
echo ""
295+
echo "Permission change syscalls:"
296+
sudo ausearch -k permission_syscalls -ts today 2>/dev/null || echo "No permission syscall events found"
297+
echo ""
298+
echo "Chown/chmod binary executions:"
299+
sudo ausearch -k chown_exec -ts today 2>/dev/null || echo "No chown execution events found"
300+
sudo ausearch -k chmod_exec -ts today 2>/dev/null || echo "No chmod execution events found"
301+
echo ""
302+
echo "Systemd execution events:"
303+
sudo ausearch -k systemd_execution -ts today 2>/dev/null || echo "No systemd execution events found"
304+
echo ""
305+
echo "All events affecting KVM device specifically:"
306+
sudo ausearch -f /dev/kvm -ts today 2>/dev/null || echo "No specific /dev/kvm events found"
307+
echo ""
308+
echo "All events affecting MSHV device specifically:"
309+
sudo ausearch -f /dev/mshv -ts today 2>/dev/null || echo "No specific /dev/mshv events found"
239310
echo ""
240-
echo "Recent audit log entries (last 50 lines):"
241-
sudo tail -50 /var/log/audit/audit.log 2>/dev/null || echo "Unable to read audit log"
311+
echo "Complete audit log entries:"
312+
sudo cat /var/log/audit/audit.log 2>/dev/null || echo "Unable to read audit log"
242313
echo ""
243-
echo "File access audit events for /dev/kvm:"
244-
sudo ausearch -f /dev/kvm -ts today 2>/dev/null || echo "No /dev/kvm access events found"
314+
echo "=== Process and System Analysis ==="
315+
echo "Currently running udev processes:"
316+
ps aux | grep -E "(udev|systemd)" | grep -v grep || echo "No udev/systemd processes found"
245317
echo ""
246-
echo "File access audit events for /dev/mshv:"
247-
sudo ausearch -f /dev/mshv -ts today 2>/dev/null || echo "No /dev/mshv access events found"
318+
echo "Udev rules containing KVM or MSHV:"
319+
find /etc/udev/rules.d/ /lib/udev/rules.d/ -name "*.rules" -exec grep -l "kvm\|mshv" {} + 2>/dev/null | xargs cat 2>/dev/null || echo "No udev rules found for hypervisor devices"
248320
echo ""
249-
echo "Permission change events:"
250-
sudo ausearch -sc chmod,fchmod,chown,fchown,lchown -ts today 2>/dev/null | grep -E "(kvm|mshv)" || echo "No permission change events for hypervisor devices found"
321+
echo "Available groups on system:"
322+
getent group | grep -E "(kvm|mshv|libvirt)" || echo "No hypervisor-related groups found"

0 commit comments

Comments
 (0)