A security issue was found in the Linux kernel. The open_by_handle_at syscall is not covered by the current file watch implementation of Auditd. This allows a local attacker with elevated privileges (CAP_DAC_READ_SEARCH capability) to read and modify files without being noticed by the implemented Auditd file watches.
This syscall can still be audited by using the 'syscall auditing feature' by passing open_by_handle_at to it in the rule. Existing auditing ruleset requirements generally use this mechanism. |