Ignore unknown syscalls on aarch64

[IvDoorn]

The auditd rules as indicated in the CIS rules, don't work on AL2023 Gravitron (aarch64) instances. The unavailable syscalls:

• unlink
• rename
• creat
• open
• chown
• lchown
• chmod

For full consistency, I've updated the checks to support the previously used auditd rule, and also added a second rule with the unavailable syscall removed.

The stime syscall is also not available, but in cis-dil-benchmark-4.1.5 this syscall is already excluded from the line.

Signed-off-by: Ivo van Doorn ivovandoorn@samotics.com

[schurzi]

I do not like the approach with describe.one here, since it would allow to use the aarch64 audit rules on x86_64 which would then not cover all required events.

I think it would be better to split the encasing if blocks into separate sections for x86_64 and aarch64. What do you think about this approach?

[IvDoorn]

I do not like the approach with describe.one here, since it would allow to use the aarch64 audit rules on x86_64 which would then not cover all required events.

I think it would be better to split the encasing if blocks into separate sections for x86_64 and aarch64. What do you think about this approach?

I'm not against it :)
Do you mean that for x86_64 we enforce:

its('content') { should match(/^-a (always,exit|exit,always) -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=#{uid_min} -F auid!=4294967295 -k delete$/) }

and for aarch64:

its('content') { should match(/^-a (always,exit|exit,always) -F arch=b64 -S unlinkat -S renameat -F auid>=#{uid_min} -F auid!=4294967295 -k delete$/) }

Or should we still use describe.one for aarch64? Because I'm not sure if the missing symbols is a thing for Amazon Gravitron specifically, or general architecture issue.

[schurzi]

Exactly.

Regarding the question if this is a ARM or a Gravitron thing I am also a bit puzzled. I have taken a look at the audit code for different architectures and I am inclined to think, that it is a general thing.

For refference:
https://github.com/linux-audit/audit-userspace/blob/master/lib/aarch64_table.h
https://github.com/linux-audit/audit-userspace/blob/master/lib/x86_64_table.h

And looking at these tables, there might be additional syscalls we need to add, to keep up with new developments in the linux kernel/audit, but that is for another PR ;)

[schurzi]

Awesome, thank you!