> Enable custom AuditD rules to watch anything it touches outside of it's sandbox.
Is auditd capitalized like SunnyD for any particular reason?
But really, what should one of these auditd rules look like? I'm imagining something like below, where *lil-agent* is the user for our agent. This would create audit logs if the user messed with any paths outside its home.
What can this rule tell me though? Since you advise running agents in an isolated machine, that ideally only has the user for the agent, the only paths the agent could mess with are system files if it had an exploit, but at that point it's game over. You'd have to hope it didn't tamper with the audit logs.
1 comment of 2
[ 2.2 ms ] story [ 17.7 ms ] threadIs auditd capitalized like SunnyD for any particular reason?
But really, what should one of these auditd rules look like? I'm imagining something like below, where *lil-agent* is the user for our agent. This would create audit logs if the user messed with any paths outside its home.
What can this rule tell me though? Since you advise running agents in an isolated machine, that ideally only has the user for the agent, the only paths the agent could mess with are system files if it had an exploit, but at that point it's game over. You'd have to hope it didn't tamper with the audit logs.