By comparing manifests from different systems, you can determine if the systems are installed identically or have been upgraded in synch. For example, if you customized your systems to a particular security target, this comparison finds any discrepancies between the manifest that represents your security target, and the manifests from the other systems.
Before You Begin
You must assume the root role. For more information, see Using Your Assigned Administrative Rights in Securing Users and Processes in Oracle Solaris 11.3.
# bart create options > control-manifest
For the options, see the bart(1M) man page.
For an example, see Step 3 in How to Create a Control Manifest.
# bart create options > test1-manifest
For example:
# cp control-manifest /net/test-server/var/adm/logs/bartlogs
If the test system is not an NFS-mounted system, use sftp or another reliable means to copy the manifests to a central location.
# bart compare control-manifest test1-manifest > test1.report
This example compares the contents of the /usr/bin directory on two systems.
Create a control manifest.
# bart create -R /usr/bin > control-manifest.090713 ! Version 1.1 ! HASH SHA256 ! Saturday, September 07, 2013 (11:11:17) # Format: #fname D size mode acl dirmtime uid gid #fname P size mode acl mtime uid gid #fname S size mode acl mtime uid gid #fname F size mode acl mtime uid gid contents #fname L size mode acl lnmtime uid gid dest #fname B size mode acl mtime uid gid devnode #fname C size mode acl mtime uid gid devnode /2to3 F 105 100555 owner@:read_data/read_xattr/write_xattr/execute/read_attribut es/write_attributes/read_acl/write_acl/write_owner/synchronize:allow,group@:read _data/read_xattr/execute/read_attributes/read_acl/synchronize:allow,everyone@:re ad_data/read_xattr/execute/read_attributes/read_acl/synchronize:allow 4bf9d261 0 2 154de3e7bdfd0d57a074c9fae0896a9e2e04bebfe5e872d273b063319e57f334 /7z F 509220 100555 owner@:read_data/read_xattr/write_xattr/execute/read_attribu tes/write_attributes/read_acl/write_acl/write_owner/synchronize:allow,group@:rea d_data/read_xattr/execute/read_attributes/read_acl/synchronize:allow,everyone@:r ead_data/read_xattr/execute/read_attributes/read_acl/synchronize:allow 4dadc48a 0 2 3ecd418eb5be3729ffe7e54053be2d33ee884205502c81ae9689cd8cca5b0090 ...
Create an identical manifest for each system that you want to compare with the control system.
# bart create -R /usr/bin > system2-manifest.101013 ! Version 1.1 ! HASH SHA256 ! Monday, October 10, 2013 (10:10:22) # Format: #fname D size mode acl dirmtime uid gid #fname P size mode acl mtime uid gid #fname S size mode acl mtime uid gid #fname F size mode acl mtime uid gid contents #fname L size mode acl lnmtime uid gid dest #fname B size mode acl mtime uid gid devnode #fname C size mode acl mtime uid gid devnode /2to3 F 105 100555 owner@:read_data/read_xattr/write_xattr/execute/read_attribut es/write_attributes/read_acl/write_acl/write_owner/synchronize:allow,group@:read _data/read_xattr/execute/read_attributes/read_acl/synchronize:allow,everyone@:re ad_data/read_xattr/execute/read_attributes/read_acl/synchronize:allow 4bf9d261 0 2 154de3e7bdfd0d57a074c9fae0896a9e2e04bebfe5e872d273b063319e57f334 ...
Copy the manifests to the same location.
# cp control-manifest.090713 /net/system2.central/bart/manifests
Compare the manifests.
# bart compare control-manifest.090713 system2.test.101013 > system2.report /su: gid control:3 test:1 /ypcat: mtime control:3fd72511 test:3fd9eb23
The output indicates that the group ID of the su file in the /usr/bin directory is not the same as that of the control system. This information might indicate that a different version of the software was installed on the test system. Because the GID is changed, the more likely reason is that someone has tampered with the file.