Merge pull request #104 from Pierre-Gronau-ndaal/patch-43

Update audit.rules
Neo23x0 · Jul 28, 2023 · 49de100 · 49de100
2 parents 80094b2 + 79852cc
commit 49de100
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/audit.rules b/audit.rules
@@ -420,6 +420,10 @@
 -w /usr/sbin/traceroute -p x -k sbin_susp
 -w /usr/sbin/ufw -p x -k sbin_susp
 
+### kde4
+-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts
+-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts
+
 ## dbus-send invocation
 ### may indicate privilege escalation CVE-2021-3560
 -w /usr/bin/dbus-send -p x -k dbus_send