Advanced Linux security

Correct — =p puts them in the permitted set without the effective bit. snapd manages this binary, so it belongs in the baseline and a change to the line is what you alert on.

Correct — Ubuntu leaves auditd out of a default install (sudo apt-get install auditd adds it); RHEL 10 installs and enables it out of the box.

Correct — On a cloud image cloud-init writes that grant into /etc/sudoers.d for its default user; it runs anything as root with no password prompt, so owning the account's key or session is owning root.

Correct — The login identity survives sudo -i, so the audit records of every program the root shell started still name deploy.

Correct — The blank column marks a low-privilege caller, and a burst of id, uname and ss from a web service account is the tell.

Correct — A key that is not in the inventory, with or without options, is a persistence and lateral-movement marker (T1098.004).

Correct — The log records the fingerprint of the key that authenticated, which ties "a key was planted" to "that key was used".

Correct — The login is kc-mover's; the root-owned monitor process opens the PAM session on its behalf, so uid=0 appears on every normal SSH login.

Correct — The first record is the SUID split, the second the target command with uid=0, and auid ties both to the person who logged in.

Correct — With sudoedit no root-owned editor process exists, so there is no root editor to escape from.

Correct — Only root can make a SUID-root file or set cap_setuid, so capture the birth and change times, the content hashes and the package ownership before anything is removed.

Correct — A pattern search is a floor, not a proof; the lesson reads process environments and unit settings with their own commands and adds shell history and unprotected private keys to the search.

Correct — An intruder's uname -r reads 211.16.1, and until the host boots 211.60.1 (or a live patch covers a given bug) those fixes do not protect it.

Correct — Write access to a directory is the right to remove and create names in it, whoever owns the files inside.

Correct — A mode change stops future reads; it cannot recall a copy already taken, so a key readable by untrusted code must be replaced.

Correct — Packages do not install into /var/tmp, and only root can create a SUID-root file, so it is an incident to capture before anything is removed.

Correct — The baseline is the detector's memory. It does nothing against root, which is why its hashes are also kept off the host.

Correct — When /etc/sudoers-rs exists, sudo-rs reads it instead of /etc/sudoers, so an intruder could replace the whole policy without touching /etc/sudoers.

Correct — Ubuntu ships a crun AppArmor profile with flags=(unconfined), so it restricts nothing; ct-web keeps podman's eleven capabilities and an enforced profile.

Correct — Each container gets different categories, so even as root one container's process cannot touch another's files, while container_t confines them all from the host.

Correct — --pid=host removes the PID namespace, not the cgroup: podman still places the container in its own scope, which marks every one of its processes.

Correct — lost counts records dropped after the backlog filled and the wait ran out; 1 is printk, 2 panics, 0 is silent.

Correct — The kernel holds a process whose call produced a record until there is room, up to backlog_wait_time, and totals that wait in backlog_wait_time_actual.

Correct — Match on names (ausearch -i shows syscall=openat) or keep a table per architecture, and never hard-code one architecture's numbers.

Correct — auid is set at login and kept through sudo; processes systemd starts never had a login, so their auid is unset and the rule skips them.

Correct — The usr merge makes /bin/passwd and /usr/bin/passwd the same file; filter on /usr/ paths or every count and alert doubles.

Correct — The audit-based publisher needs the kernel audit connection that auditd holds; the eBPF one reads events through its own programs.

Correct — 1 would lock it off until reboot, and 0 would allow some unprivileged program types. Both lab platforms default to 2.

Correct — Application logs never show a refused open, because the program wrote nothing; an audit rule on that file would record it, but only for files chosen in advance.

Correct — auditd switched auditing on here; on a default Ubuntu install without auditd, audit starts disabled and the same loads leave no BPF record at all.

Correct — Hooks deeper in the kernel, on the file-open path itself, fire however the request arrived, which a system-call tracepoint cannot promise.

Correct — Capture started with the intended driver; the notices describe the architecture, and detection continues.

Correct — Filter the journal by the unit's current InvocationID and look for "Opening 'syscall' source with modern BPF probe".

Correct — The loginuid names the human behind root. A root read by an administrator is often legitimate, which is a question for triage, not for the rule.

Correct — Paths and names cost more than hashes or addresses but far less than the technique, which is why path rules go blind after a rename.

Correct — auditctl(8) says the event triggers on the first matching rule. Test detection rules one at a time, and treat order as part of the design.

Correct — The two det_behav events are the sysmon and kswapd0 runs. Low volume on normal activity is what a rule needs before it pages anyone.

Correct — That gap is why a behaviour rule belongs in a portfolio, paired with other rules and a written list of what you cannot yet see.

Correct — RHEL ends its presets with "disable *", while Ubuntu has no catch-all and systemd treats a unit no preset line matches as enable (systemd.preset(5)).

Correct — ps loses the lineage once a process is re-parented, while execve records keep the ppid it had when it started.

Correct — It names one behaviour and the trace it must leave, so find -newerct plus dpkg -S or rpm -qf can answer it; mtime is a cheap first filter that a backdated plant defeats.

Correct — No managed unit accounts for port 8081, so follow the process's arguments, owner and origin, and capture before you stop it.

Correct — There is no /run/utmp on this release, so who has nothing to read while systemd-logind tracks the live sessions.

Correct — The architecture rules out AVML; with lockdown off and signing not enforced, LEMON or LiME are options on this host.

Correct — An accept in one chain can still be dropped by a later chain, but a drop ends the packet's path, so running first and dropping by policy makes the quarantine hold.

Correct — A quarantine VLAN or a locked-down security group sits where the intruder's root cannot reach it.

Correct — touch set mtime to 2025 and the kernel set ctime to the moment of the touch; stat, through statx, can still show the birth time.

Correct — Forward Secure Sealing needs journalctl --setup-keys and a verification key kept elsewhere, and neither platform sets one up by default.

Correct — The monitor logs authentication and PAM, the child logs the disconnect, so the port links them where the PID does not.

Correct — ignoreboth includes ignorespace, which skips lines that begin with a space, while RHEL's /etc/profile sets ignoredups alone.

Correct — Packages install units under /usr/lib/systemd/system, and on Ubuntu a unit no preset file names defaults to enabled anyway.

Correct — A crash-looping unit and repeated denied execute records make a strong alert, not a guarantee.

Correct — No command proves a negative. Recovery from a root compromise means a rebuild, clean data, a closed way in and rotated secrets, with an indicator check before return.