Configure Audit Rules for Privilege Escalation Operations

In openEuler, logs of privilege escalation operations using the sudo command are recorded in the /var/log/secure file by default. This file also records other authentication-related security logs. If you want to audit privilege escalation operations using sudo, you are advised to record logs...

Configure Audit Rules for File System Mounting

Generally, for deployed services, the file system mounting does not change. Therefore, any change in the file system mounting may indicate attacks. For file systems with changes in mounting, audit and monitor their mounting conditions for tracing. By default, audit rules for file system mounting...

Configure a Proper Default Zone

The firewalld service allows several independent rule zones to be created on a firewall based on the zone concept. Different interfaces or source addresses can be bound to different zones to implement different control logic. A zone can be configured with many different network interfaces or sour...

Do Not Use auditctl to Set auditd Rules

auditd service rules can be configured using either rule files in the /etc/audit/rules.d/ directory applied after server restart or the auditctl command for immediate effect. The permission of the /etc/audit/rules.d/ directory is 750, while that of the auditctl command is 755. Therefore,...

Configure Audit Rules for Privilege-Escalated Commands

Users can call privilege-escalated commands that is, commands with SUID/SGID bits to obtain the super administrator permissions. This operation is risky and often exploited by attackers. You are advised to audit and monitor privilege-escalated commands for future tracing. By default, audit rules...

Ensure That auditd Is Enabled

The auditd component is a user-space component of the Linux audit framework, providing the auditctl, ausearch, and aureport programs to audit and view logs. Audit rules are configured using the auditctl program. When getting started, auditctl reads these rules from /etc/audit/audit.rules. The aud...

Configure the Kernel Parameter ptrace_scope Properly

ptrace is a system call used for process tracing. It provides the capability for a parent process to observe and control child processes. Linux Kernel 3.4 and later versions support completely restricting or disabling the ptrace function. According to the Linux Kernel Yama Documentation, the...

Configure sudoers Audit Rules

The sudo command allows common users to perform privileged operations as the root user, which is highly risky. Though attackers cannot access the root user easily, they can escalate the privilege using the sudo command. You are advised to configure audit for the /etc/sudoers file and the...

Configure Audit Rules for File Deletion

Generally, it is highly risky to delete files in the OS. Misoperations by administrators or attacks may cause severe system faults. You are advised to audit and monitor system calls, such as rename, unlink, unlinkat, and renameat, and record deletion operation logs. Deleting system or service fil...

Configure Audit Rules for File Access Control Permissions

File access permission control is the basic permission management in Linux. Different users can access different files after being authorized. This prevents sensitive information leakage or file data tampering between users and prevents common users from accessing high-permission files or...

Configure the Authentication Blocklist and Allowlist Properly

SSH provides the blocklist and allowlist function. You can set a list of users or user groups to allow or deny SSH login for them. By default, this function is not configured in openEuler. The related fields are as follows: AllowUsers userlist specifies the space-separated users who are allowed t...

Configure Audit Rules for Kernel Module Changes

Generally, for deployed services, the loaded kernel modules do not change. Therefore, changes in loaded kernel modules may indicate attacks. You are advised to audit and monitor kernel module changes for future tracing. By default, audit rules for kernel module changes are not configured in...

Configure Audit Rules for Network Environment

Attackers may change the system domain name and host name to launch attacks, such as host spoofing. It is recommended that the user set the audit of system calls setdomainname and sethostname and the audit of the /etc/hosts file to monitor changes in the system domain name and host name. You can...

WordPress plugin for dynamic pricing with discount rules for WooCommerce – SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A SQL injection vulnerability exists in the WordPress...

Malicious code in make-plural-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef999981379280f98605a8386dda39c26b1b27975f440cb627710a7f01a213ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3635 Malicious code in make-plural-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef999981379280f98605a8386dda39c26b1b27975f440cb627710a7f01a213ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in make-plural-rules

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

GO-2025-3652 Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements in github.com/kyverno/kyverno

Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements in github.com/kyverno/kyverno...

SUSE CVE-2023-53079

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix steering rules cleanup vport's mc, uc and multicast rules are not deleted in teardown path when EEH happens. Since the vport's promisc settingsuc, mc and all in firmware are reset after EEH, mlx5 driver will try to...

CVE-2023-53079

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix steering rules cleanup vport's mc, uc and multicast rules are not deleted in teardown path when EEH happens. Since the vport's promisc settingsuc, mc and all in firmware are reset after EEH, mlx5 driver will try to...