public inbox for linux-audit@redhat.com
 help / color / mirror / Atom feed
* Excluding the single executable on the top of audit.rules
@ 2014-08-19 11:07 Исаев Виталий Анатольевич
  2014-08-19 20:32 ` Steve Grubb
  0 siblings, 1 reply; 3+ messages in thread
From: Исаев Виталий Анатольевич @ 2014-08-19 11:07 UTC (permalink / raw)
  To: linux-audit@redhat.com


[-- Attachment #1.1: Type: text/plain, Size: 2684 bytes --]

Hello all,

I would like to ask for an explanation about making my audit.rules proper. What am I trying to do is to exclude all the syscall events coming from exe="/usr/bin/pulseaudio" and its components. At the moment about 95% of audit log is filled with messages related to pulseaudio:

# aureport -x -if my.log --summary
Executable Summary Report
=================================
total  file
=================================
1156923  /usr/bin/pulseaudio
191719  /usr/libexec/pulse/gconf-helper
49282  /usr/bin/gnome-volume-control-applet
8035  /usr/libexec/gnome-settings-daemon
1045  /usr/sbin/crond
265  /usr/bin/nautilus
23  /usr/sbin/sshd

Please look through the current version of audit.rules. How should I modify them?

# First rule - delete all
-D

# Increase the buffers to survive stress events.
# Make this bigger for busy systems
-b 320

# Feel free to add below this line. See auditctl man page
#-a exit,never -F exe=/usr/bin/pulseaudio -S open
-a exit,always -F arch=x86_64 -F uid>=500 -F gid>=500 -F ppid!=1 -F auid!=429496729 -S open
-a exit,always -F arch=x86_64 -F uid>=500 -F gid>=500 -F ppid!=1 -F auid!=429496729 -S execve
-a exit,always -F arch=x86_64 -F uid>=500 -F gid>=500 -F ppid!=1 -F auid!=429496729 -S fork
-a exit,always -F arch=x86_64 -F uid>=500 -F gid>=500 -F ppid!=1 -F auid!=429496729 -S vfork
-a exit,always -F arch=x86_64 -F uid>=500 -F gid>=500 -F ppid!=1 -F auid!=429496729 -S exit
-a exit,always -F arch=x86_64 -F uid>=500 -F gid>=500 -F ppid!=1 -F auid!=429496729 -S exit_group
-a exit,always -F arch=x86_64 -F uid>=500 -F gid>=500 -F ppid!=1 -F auid!=429496729 -S getdents
-a exit,always -F arch=x86_64 -F uid>=500 -F gid>=500 -F ppid!=1 -F auid!=429496729 -S chmod
-a exit,always -F arch=x86_64 -F uid>=500 -F gid>=500 -F ppid!=1 -F auid!=429496729 -S fchmod
-a exit,always -F arch=x86_64 -F uid>=500 -F gid>=500 -F ppid!=1 -F auid!=429496729 -S fchmodat
-a exit,always -F arch=x86_64 -F uid>=500 -F gid>=500 -F ppid!=1 -F auid!=429496729 -S chown
-a exit,always -F arch=x86_64 -F uid>=500 -F gid>=500 -F ppid!=1 -F auid!=429496729 -S fchown
-a exit,always -F arch=x86_64 -F uid>=500 -F gid>=500 -F ppid!=1 -F auid!=429496729 -S lchown
-a exit,always -F arch=x86_64 -F uid>=500 -F gid>=500 -F ppid!=1 -F auid!=429496729 -S fchownat
-a exit,always -F arch=x86_64 -F uid>=500 -F gid>=500 -F ppid!=1 -F auid!=429496729 -S unlink
-a exit,always -F arch=x86_64 -F uid>=500 -F gid>=500 -F ppid!=1 -F auid!=429496729 -S unlinkat

P.S. We're using RHEL 6.4 with audit-2.2-2.el6.x86_64.

Sincerely,
Vitaly Isaev
Software engineer
Information security department
Fintech JSC, Moscow, Russia


[-- Attachment #1.2: Type: text/html, Size: 10925 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]



^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2014-08-20  9:47 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-08-19 11:07 Excluding the single executable on the top of audit.rules Исаев Виталий Анатольевич
2014-08-19 20:32 ` Steve Grubb
2014-08-20  9:47   ` Исаев Виталий Анатольевич

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox