Host Intrusion Detection System Administrator's Guide Release 3.1

Templates and Alerts
Race Condition Template
Appendix A
147
NOTE See Table B-1 and Table B-2 in Appendix B for the definition of additional arguments
that can be used to access specific alert information (for example, pid and ppid) without
having to parse the string alert fields.
Limitations This template can be CPU intensive because it is monitoring all file references on the
system.
argv[8] Details String User with <uid> running as process
with pid<pid> and with parent
pid <ppid> is executing the
privileged setuid script <full
pathname>(type=<type>,
inode=<inode>,
device=<device), invoked as
follows: <argv[0]
argv[1]...,[*perhaps*] via a
symbolic link. Privileged setuid
script owned by user with uid
<uid>. A privileged setuid script
is vulnerable to a race condition
attack.
Detailed alert
description
argv[9] Local Time Integer <secs> Local time in
number of seconds
since epoch when a
privileged setuid
script was executed
Table A-8 setuid Script Executed Alert Properties (Continued)
Response
Program
Argument
Alert Field
Alert
Field
Type
Alert Value/Format Description