In this lesson, you will learn how to configure the Linux Audit framework to capture the provenance and execution details of privileged binaries, ensuring you have a verifiable trail of who ran what and when.
While tools like procfs allow you to inspect a process currently in memory, they do not provide a persistent, tamper-resistant history of execution. To track privileged binaries—files that often run with root privileges (like those with the SUID bit set)—we use the auditd subsystem.
Configuring Audit Rules
The audit system operates by placing "watches" on files or system calls. To track the execution of a sensitive binary, you define a rule in /etc/audit/rules.d/audit.rules.
For example, to monitor every time a user executes the /usr/bin/passwd command (a privileged binary), you would add this line to your configuration:
-w /usr/bin/passwd -p x -k privileged-passwd-exec
-w: Specifies the file to watch.-p x: Tells the system to watch for eXecution attempts.-k: Assigns a filter key (like a tag) so you can easily search for these specific logs later.
Analyzing the Provenance
Once the rule is active and the service is reloaded (augenrules --load), the kernel logs an entry whenever the binary is invoked. Because we correlated process lifecycles in previous lessons, you can link these logs to user IDs (uid), session IDs (ses), and the parent process ID (ppid).
When you search for these logs using ausearch -k privileged-passwd-exec, you aren't just seeing that the file was run; you are seeing the audit daemon capture the security context of the initiator. This is essential for distinguishing between a legitimate system update and a malicious actor attempting to escalate privileges via an unexpected execution path.
By tying these execution audits to the process lifecycles we have studied, you can reconstruct exactly how a process originated and whether its execution footprint aligns with your system’s security policy.
Key Takeaway: By placing audit watches on privileged binaries, you create an immutable record of execution that allows you to trace the provenance of sensitive processes back to the specific user session that triggered them.