Okay, I'll try... but BSM auditing is still pretty much voodoo to me, so I'm trying to piece together the way I had it set up based on experimentation and a very vague memory... so it will require some experimentation on your part.
I had this in
/etc/security/audit_user:
... which I
believe will cause www user to audit all execve() style function calls. Don't forget to restart
auditd after changing that stuff, and of course make sure it's running (that was my first gotcha when trying to recreate a working setup just now).
The issue is that "www" will never "log in" to set the audit context, which is what
setaudit is for. This caused Apache to successfully audit all execve() functions for me:
# setaudit -a www -m ex /usr/local/etc/rc.d/apache22 restart
Then I can see the events through
praudit:
# praudit /dev/auditpipe0
Code:
header,167,10,execve(2),0,Thu May 26 14:15:55 2011, + 738 msec
exec arg,/usr/local/bin/php-cgi
exec env,TZ=EST5EDT
path,/usr/local/bin/php-cgi
attribute,755,root,wheel,105,41199924,164635936
subject,www,www,www,www,www,6186,0,0,0.0.0.0
return,success,0
trailer,167
I then used
security/bsmtrace to set up a white list of things that were acceptable for Apache to be executing (eg,
php-cgi, via mod_fcgid), and had it alert me if anything else ran (ie,
perl,
python, or
php, would indicate someone trying to exec() a long-running script and that one of my scripts got owned). I think I also had it set up to alert, very loudly, on execve() events on anything inside of /tmp.
My setup was definitely not failure-proof, and did provide false-positives (for example, most PHP forum packages can't trust one particular PHP function for some reason or another, IIRC it was something to do with getting the time, and so would exec() a system binary every chance they got to get it) but it did work. Note that if you were running suexec or whatever, you'd probably want to open up the context a bit more than just the www uid.
I have no idea how these exact settings apply to your particular use case, that's an exercise for you to figure out, but
setaudit worked for me at one point. Maybe someone much better versed in it than me can point you further in the right direction, and/or correct any mistakes I've made above.
