![](/images/new-backgrounds/1308409/308409337x1.webp)
|
|
|
|
|
| Templates and Alerts |
|
|
|
|
| Creation of Setuid File Template | |
Table |
| Setuid File Created Alert Properties (Continued) |
| |||
|
|
|
|
|
|
|
| Response |
|
| Alert Field |
|
|
| Program | Alert Field | Alert Value/Format | Description | ||
| Type | |||||
| Argument |
|
|
|
| |
|
|
|
|
|
| |
|
|
|
|
|
| |
| argv[8] | Details | String | “User with uid <uid> <performed | Detailed alert | |
|
|
|
|
| action on> the file <full | description |
|
|
|
|
| pathname>(type=<type>,inode=<in |
|
|
|
|
|
| ode>, device<device) when |
|
|
|
|
|
| executing |
|
|
|
|
|
| <program>>(type=<type>,inode=<i |
|
|
|
|
|
| node>,device=<device>), invoked as |
|
|
|
|
|
| follows: <argv[0]> <argv[1]>..., as |
|
|
|
|
|
| process with pid <pid> and ppid |
|
|
|
|
|
| <ppid> and running with effective |
|
|
|
|
|
| uid=<euid> and with effective |
|
|
|
|
|
| gid=<egid>. |
|
|
|
|
|
| where <performed action on> is set |
|
|
|
|
|
| to one of the following: |
|
|
|
|
|
| "created the setuid file" |
|
|
|
|
|
| "changed the owner of the setuid |
|
|
|
|
|
| file" |
|
|
|
|
|
| "enabled the setuid bit on file" |
|
|
|
|
|
| "performed system call <number> |
|
|
|
|
|
| on the file" |
|
|
|
|
|
|
| |
| argv[9] | Local Time | Integer | <secs> | Local time in | |
|
|
|
|
|
| number of seconds |
|
|
|
|
|
| since epoch when a |
|
|
|
|
|
| privileged setuid |
|
|
|
|
|
| file is created. |
|
|
|
|
|
|
|
|
|
| Refer to Table | |||
NOTE |
| |||||
|
|
| be used to access specific alert information (ie., pid, ppid) without having to parse the | |||
|
|
| string alert fields above. |
|
| |
|
|
|
|
|
|
|
Limitations | • The template cannot distinguish between whether a file is created or truncated |
| when creat(2) is invoked. |
Appendix A | 157 |