bsmtrace.conf

#
# Define our logging channels
#
log-channel $syslog <syslog> {
	priority user.notice;
};

log-channel $bsm <bsm> {
	directory "/usr/bsm";
};

define set $my_log_channels <logchannel> {
	$bsm,
	$syslog;
};

#
# Define subject (or user) groupings
#
define set $fwadmins <auid> {
	alm,
	csjp;
};

#
# Define various event groups that we are interested in
#
define set $execution <auditevent> {
	AUE_EXEC,
	AUE_EXECVE;
};

define set $login <auditevent> {
	AUE_openssh,
	AUE_login,
	AUE_su;
};

#
# Define our object (or file) groups
#
define set $trusteddirs <path> {
	/bin,
	/sbin,
	/usr/bin,
	/usr/sbin,
	/usr/local/bin,
	/usr/X11R6/bin,
	/usr/local/sbin,
	/usr/games;
};

define set $opendirs <path> {
	/tmp,
	/var/tmp;
};

define set $fwtools <path> {
	/sbin/ipfw,
	/sbin/pfctl,
	/sbin/ipf;
};

############################################################
#
# Define our state machines or actual "IDS signatures"
#
############################################################

#
#
# XXX add a sequence which detects system accounts executing code
#
#
sequence firewall.change.attempt {
	subject not $fwadmins;
	state {
		event $execution;
		object $fwtools;
		status any;
	};
};

sequence non.trusted.exec {
	subject any;
	state {
		event $execution;
		object not $trusteddirs;
		trigger "/usr/bin/logger non.trusted.exec: $subject executed $object";
		status success;
	};
};

sequence mktemp.race {
	subject any;
	state {
		event <auditevent> { AUE_SYMLINK; };
		object $opendirs;
		status success;
	};
};

sequence login.brute.force {
	subject any;
	log <logchannel> { $bsm; };
	state {
		event $login;
		status failure;
		multiplier 2;
	};
	state {
		event $login;
		status success;
	};
};

sequence httpd.exec {
	subject <auid> { nobody; };
	state {
		event <auditevent> { AUE_SOCKET; };
		status success;
	};
	state {
		event <auditevent> { AUE_BIND; };
		status success;
	};
	state {
		event $execution;
		status any;
	};
};

sequence named.exec {
	subject <auid> { bind; };
	scope process;
	state {
		event <auditevent> { AUE_SOCKET; };
		status success;
	};
	state {
		event <auditevent> { AUE_BIND; };
		status success;
	};
	state {
		event $execution;
		status any;
	};
};

sequence failed.file.write {
	subject <auid> { csjp; };
	state {
		event <auditclass> { fw; };
		status failure;
	};
};

#
# This is a comment
#
sequence five.config.file.read {
	subject <auid> { csjp; };
	serial 2343445445;
	timeout 60 seconds;
	scope global;
	priority 100;
	state {
		event <auditclass> { fr; };
		status any;
		object <path> { /etc; };
		trigger "/usr/bin/logger config file read";
		multiplier 5;
	};
};

sequence passwd.access {
	subject any;
	state {
		event <auditclass> { fr; };
		status any;
		object <pcre> { /etc/pass[Ww][Dd]; };
		multiplier 5;
	};
};

sequence etc.access {
	subject any;
	state {
		event <auditclass> { fr; };
		status any;
		object <pcre> { /[Ee][Tt][Cc]/*; };
	};
};

sequence coredump {
	subject any;
	state {
		event <auditevent> { AUE_CORE; };
		status any;
	};
};