From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Way too many logs! Date: Sat, 10 May 2008 20:41:38 -0400 Message-ID: <200805102041.38461.sgrubb@redhat.com> References: <482479DC020000100005CB37@gsi.gracon.com> <200805091643.38420.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: Received: from mail.boston.redhat.com (mail.boston.redhat.com [10.16.255.12]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id m4B0gKSR005652 for ; Sat, 10 May 2008 20:42:20 -0400 Received: from vpn-14-134.rdu.redhat.com (vpn-14-134.rdu.redhat.com [10.11.14.134]) by mail.boston.redhat.com (8.13.1/8.13.1) with ESMTP id m4B0gFop029344 for ; Sat, 10 May 2008 20:42:20 -0400 In-Reply-To: <200805091643.38420.sgrubb@redhat.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Friday 09 May 2008 16:43:38 Steve Grubb wrote: > > The rules I have above are required by the government. DIACAP STIG > > Do you need to log all changes to the scheduler? Or just the changes caused > by users? If the latter, you can cut back your events like this: > > -a exit,always -S sched_setparam -S sched_setscheduler -F auid>=500 -k > RULE7 I should mention the above rule is probably not correct. It better to state it this way: a exit,always -F arch=b32 -S sched_setparam -S sched_setscheduler -F auid>=500 -F auid!=4294967295 -k RULE7 a exit,always -F arch=b64 -S sched_setparam -S sched_setscheduler -F auid>=500 -F auid!=4294967295 -k RULE7 The reason why is that you also have to check for the unset auid and set a rule for each arch if its a bi-arch system (x86_64). -Steve