HP-UX Host Intrusion Detection System Version 4.4 Administrator Guide (5900-1634, April 2011)

priv_user_list A list of system-level user IDs or user names.
This list contains those users who have elevated access to the
system. Removing any of these users means that the
setuid/setgid template will not detect the creation of a
setuid file owned by one of those users.
priv_group_list A list of system-level group IDs or group names.
This list contains those groups who have elevated access to
the system. Removing any of these groups from this list means
that the setuid/setgid template will not detect the creation of
a setgid file owned by one of those groups.
pathnames_X, programs_X Filter out alerts generated when a specified program creates,
modifies, or enables a specified privileged setuid file. See
“Type II: Path Names/Programs Pairs” (page 108) for a
detailed description of these property pairs.
Alerts generated by this template
Setuid or setgid File Created or Modified
Table A-16 lists the alert properties the setuid/setgid template generates and forwards to a response
program when a setuid or setgid file owned by a privileged user or privileged group is created
or modified.
Table 26 Setuid File Created / Modified Alert Properties
DescriptionAlert Value/FormatAlert Field
Type
Alert FieldResponse
Program
Argument
Unique code assigned to
template
4IntegerTemplate codeargv[1]
Template Version<version>IntegerVersionargv[2]
Alert Severity1IntegerSeverityargv[3]
UTC time in number of
seconds since the epoch when
a privileged setuid file was
created or modified
<secs>IntegerUTC timeargv[4]
The user ID, group ID, process
ID, and parent process ID of
the process that created or
modified the privileged setuid
file
uid=<uid>, gid=<gid>,
pid=<pid>, ppid=<ppid>
StringAttackerargv[5]
The full path name of the
privileged setuid file and the
file’s type, mode, uid,
gid, inode, and device
number
file=<full pathname>,
type=<type>, mode=<mode>,
uid=<uid>, gid=<gid>,
inode=<inode>, device=<device>
StringTarget of Attackargv[6]
Alert summarysetuid file created,or
setuid file potentially modified, or
setuid file truncated, or operation
on setuid file
StringSummaryargv[7]
Creation and Modification of setuid/setgid File Template 131