Setting priority to auditd rule files

Setting priority to auditd rule files

[Anurag Aggarwal]

[-- Attachment #1.1: Type: text/plain, Size: 342 bytes --]

Hello All,

As per my understanding, currently auditd picks up rule files as per
alphabetical order.
Is there a way to force auditd to prioritize which rule file should be
first read and applied, other than renaming it as 000-<app>.rules and
hoping that customers don't have anything lexicographically smaller than
this?

-- 
Anurag Aggarwal

[-- Attachment #1.2: Type: text/html, Size: 519 bytes --]

[-- Attachment #2: Type: text/plain, Size: 107 bytes --]

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: Setting priority to auditd rule files

[Steve Grubb]

Hello,

On Monday, January 30, 2023 12:21:53 AM EST Anurag Aggarwal wrote:
> As per my understanding, currently auditd picks up rule files as per
> alphabetical order.

Auditd picks up the rules in /etc/audit/audit.rules  That in turn is compiled 
by augenrules which uses the order as given from "ls -v".

> Is there a way to force auditd to prioritize which rule file should be
> first read and applied, other than renaming it as 000-<app>.rules and
> hoping that customers don't have anything lexicographically smaller than
> this?

You can use "ls -v" to figure out how to make a rule that is ahead of 10-base-
config.rules. even 10-a.rule should go first. Or you can rename 10-base-
config.rules to be a higher number.

-Steve


--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit