From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: Question about updating audit.rules
Date: Wed, 22 Jun 2016 23:16:54 -0400
Message-ID: <2349183.vbY8BNKUko@x2>
References: <CAJdJdQ=3p+ukfg6MguaBNiG69jq9fp3bK-VGEZ=Xbij=yKBpBg@mail.gmail.com>
	<CAJdJdQ=NayH8o4LxXgyL8k4VQ_aPYKC82hB987wEmU4TbF22+A@mail.gmail.com>
	<CAJdJdQkQWy0FFDgHc+gKZbN524qbzonNASTypTEsxAsQ4ty7nA@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <CAJdJdQkQWy0FFDgHc+gKZbN524qbzonNASTypTEsxAsQ4ty7nA@mail.gmail.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Wednesday, June 22, 2016 07:56:23 PM warron.french wrote:
> I am writing puppet modules for work now. I am writing a module
> specifically oriented around audit for Linux and Solaris.
> 
> But I would like to know is after updating audit.rules in Linux with
> immutable mode turned on; is a restart of the audit process actually
> required for the rules to take effect.

In immutable mode, a REBOOT is required to reload audit rules. In immutable 
mode, the rules are locked into the kernel. So, the kernel needs restarting.

-Steve