Disable auto rewriting of files
@MarioHewardt ya está trabajando en esto.
Desde el 24/8/2024.
Evaluación
Este issue todavía no se ha evaluado.
Descripción
Describe the bug
sysmon regularly rewrites file in /opt/sysmon and systemd unit file. It triggers changes in Host IDS like aide like:
d =.... mc.. .. . : /etc/systemd/system
f =.... mc..... . : /etc/systemd/system/sysmon.service
d =.... mc.. .. . : /opt/sysmon
f =.... mc..H.. . : /opt/sysmon/eventId
f =.... mc..... . : /opt/sysmon/rules.bin
f =.... mci.... . : /opt/sysmon/sysmon
f =.... mc..... . : /opt/sysmon/sysmonEBPFkern4.15.o
f =b... mc..... . : /opt/sysmon/sysmonEBPFkern4.15_core.o
f =.... mc..... . : /opt/sysmon/sysmonEBPFkern4.16.o
f =b... mc..... . : /opt/sysmon/sysmonEBPFkern4.16_core.o
f =.... mc..... . : /opt/sysmon/sysmonEBPFkern4.17-5.1.o
f =.... mc..... . : /opt/sysmon/sysmonEBPFkern4.17-5.1_core.o
f =b... mc..... . : /opt/sysmon/sysmonEBPFkern5.2.o
f =.... mc..... . : /opt/sysmon/sysmonEBPFkern5.2_core.o
f =.... mc..... . : /opt/sysmon/sysmonEBPFkern5.3-5.5.o
f =.... mc..... . : /opt/sysmon/sysmonEBPFkern5.3-5.5_core.o
f =b... mc..... . : /opt/sysmon/sysmonEBPFkern5.6-.o
f =.... mc..... . : /opt/sysmon/sysmonEBPFkern5.6-_core.o
f =.... mc..... . : /opt/sysmon/sysmonLogView
from aide.conf man
o A b means that the block count has changed.
o A m means that the modification time has changed.
o A c means that the change time has changed.
o An i means that the inode has changed.
o A H means that one or more message digests have changed.
is there any way to disable this behaviour especially as files are unchanged most of the time?
I can mark files as immutable but prefer fixing at source and only have changes when package is updated (or kernel).
To Reproduce
Install sysmon and hids like aide. Aide Debian (or Ubuntu) has a daily check task by default.
Sysmon version
1.3.3 (upstream package)
Distro/kernel version
# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 22.04.4 LTS
Release: 22.04
Codename: jammy
# uname -a
Linux HOST 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
Sysmon configuration
Irrelevant
Logs
Irrelevant
Expected behavior
files including all binaries and kernel modules should not be changed without a defined action, typically package update of sysmon or kernel updates.
In its current form, it happens by itself even if no sysmon or kernel update and without configuration options.
Additional context
No change should happen to system without a controlled change operated by administrator or delegated systems, especially more on binaries and kernel modules.
Likely create issues for immutable systems.
- Lenguaje dominante
- C
- Estrellas
- 2.2k
- Forks
- 220
- Merge medio
- 11 d 22 h
- PR fusionados (30 d)
- 2
Guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de microsoft/SysmonForLinux
-
microsoft/SysmonForLinux#238 · 1 asignado ·
-
Dificultad 4/5 3-5 días Aptitud para principiantes 35/100
microsoft/SysmonForLinux#233 ·
-
microsoft/SysmonForLinux#230 · 1 asignado ·
-
microsoft/SysmonForLinux#226 · 1 asignado ·
-
Dificultad 5/5 Más de una semana Aptitud para principiantes 25/100
microsoft/SysmonForLinux#220 · 2 reacciones ·
Todos los issues de microsoft/SysmonForLinux
Issues similares
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 65/100
duckdb/duckdb-wasm#2258 ·
-
how does install.sh work Abierto
Dificultad 1/5 Menos de una hora Aptitud para principiantes 90/100
rofl0r/microsocks#110 ·
-
OTA is not aborted correctly Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 65/100
espressif/esp-aws-iot#261 ·
-
os:linux
Dificultad 2/5 1-3 horas Aptitud para principiantes 70/100
mpv-player/mpv#18510 · 2 comentarios ·
-
Dificultad 1/5 Menos de una hora Aptitud para principiantes 85/100