Disable auto rewriting of files

未关闭
  • 哪里不对？
#184 4 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

@MarioHewardt 已经在做这个了。

开始于 2024年8月24日。

评估

这个 Issue 还没有评估数据。

描述

investigate

Describe the bug

sysmon regularly rewrites file in /opt/sysmon and systemd unit file. It triggers changes in Host IDS like aide like:
d =.... mc.. .. . : /etc/systemd/system
f =.... mc..... . : /etc/systemd/system/sysmon.service
d =.... mc.. .. . : /opt/sysmon
f =.... mc..H.. . : /opt/sysmon/eventId
f =.... mc..... . : /opt/sysmon/rules.bin
f =.... mci.... . : /opt/sysmon/sysmon
f =.... mc..... . : /opt/sysmon/sysmonEBPFkern4.15.o
f =b... mc..... . : /opt/sysmon/sysmonEBPFkern4.15_core.o
f =.... mc..... . : /opt/sysmon/sysmonEBPFkern4.16.o
f =b... mc..... . : /opt/sysmon/sysmonEBPFkern4.16_core.o
f =.... mc..... . : /opt/sysmon/sysmonEBPFkern4.17-5.1.o
f =.... mc..... . : /opt/sysmon/sysmonEBPFkern4.17-5.1_core.o
f =b... mc..... . : /opt/sysmon/sysmonEBPFkern5.2.o
f =.... mc..... . : /opt/sysmon/sysmonEBPFkern5.2_core.o
f =.... mc..... . : /opt/sysmon/sysmonEBPFkern5.3-5.5.o
f =.... mc..... . : /opt/sysmon/sysmonEBPFkern5.3-5.5_core.o
f =b... mc..... . : /opt/sysmon/sysmonEBPFkern5.6-.o
f =.... mc..... . : /opt/sysmon/sysmonEBPFkern5.6-_core.o
f =.... mc..... . : /opt/sysmon/sysmonLogView

from aide.conf man
o A b means that the block count has changed.
o A m means that the modification time has changed.
o A c means that the change time has changed.
o An i means that the inode has changed.
o A H means that one or more message digests have changed.

is there any way to disable this behaviour especially as files are unchanged most of the time?
I can mark files as immutable but prefer fixing at source and only have changes when package is updated (or kernel).

To Reproduce
Install sysmon and hids like aide. Aide Debian (or Ubuntu) has a daily check task by default.

Sysmon version
1.3.3 (upstream package)

Distro/kernel version

# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 22.04.4 LTS
Release:        22.04
Codename:       jammy
# uname -a
Linux HOST 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

Sysmon configuration
Irrelevant

Logs
Irrelevant

Expected behavior
files including all binaries and kernel modules should not be changed without a defined action, typically package update of sysmon or kernel updates.
In its current form, it happens by itself even if no sysmon or kernel update and without configuration options.

Additional context
No change should happen to system without a controlled change operated by administrator or delegated systems, especially more on binaries and kernel modules.
Likely create issues for immutable systems.

主要语言
C
星标
2.2k
派生
222
平均合并
4 小时 50 分钟
30 天内合并 PR
3

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

microsoft/Sysmon-Linux 的其他 Issue

查看 microsoft/Sysmon-Linux 的全部 Issue

相似的 Issue

更多 C Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。