Audit rule that applies when auid >= 500

Audit rule that applies when auid >= 500

[Søren Olesen]

[-- Attachment #1.1: Type: text/plain, Size: 1484 bytes --]

Hello,
 
I would like some of my audit rules to apply when auid >= 500 
 
For example consider this use case:
 
[root@localhost audit]# auditctl -v
auditctl version 1.3.1
 
[root@localhost audit]# cat /etc/audit/audit.rules
# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via the initscripts.
# The rules are simply the parameters that would be passed
# to auditctl.
 
# First rule - delete all
-D
 
# Increase the buffers to survive stress events.
# Make this bigger for busy systems
-b 256
 
# Feel free to add below this line. See auditctl man page
 
-a exit,always -S socketcall -F a0=4 -F auid>=500 -k eq_greater_than_test
 
[root@localhost audit]# /etc/init.d/auditd restart
Stopping auditd:                                           [  OK  ]
Starting auditd:                                           [  OK  ]

[root@localhost audit]# auditctl -l
LIST_RULES: exit,always a0=4 (0x4) auid=500 (0x1f4) key=eq_greater_than_test syscall=socketcall

 
In "/etc/audit/audit.rules" I specify that "auid>=500" but "auditctl -l" shows that the rule matches "auid=500".
 
What is the syntax for creating a rule that applies when auid>=500 ?
 
 

Med venlig hilsen / kind regards

Søren Olesen
Systems Engineer

Systematic Software Engineering A/S
Søren Frichs Vej 39, DK-8000  Aarhus C
Tel.: +45 8943 2055
Fax: +45 8943 2020
Web: www.systematic.dk <blocked::http://www.systematic.dk/> 

 

[-- Attachment #1.2: Type: text/html, Size: 6704 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Audit rule that applies when auid >= 500

[Steve Grubb]

On Monday 06 August 2007 09:48:41 am Søren Olesen wrote:
> [root@localhost audit]# auditctl -v
> auditctl version 1.3.1

There may have been a bug in that version. I remember a problem where it 
wasn't upgrading the rule from the old kind to the new kind correctly. (It 
tries to use the old rule style for communicating with the kernel for 
backward compatibility with old kernels - pre-2.6.16) There is slightly newer 
RHEL5 audit packages here: 

http://people.redhat.com/sgrubb/files/lspp/

But the RHEL5.1 package 1.5.5-5 should work fine:

#  auditctl -a exit,always -S open -F "auid>=500"
#  auditctl -l
LIST_RULES: exit,always auid>=500 (0x1f4) syscall=open

-Steve