audit rules placement

audit rules placement

[Lev Stipakov]

Hello,

I have a rpm/deb package which includes audisp plugin. In order plugin 
to work, I need to permanently add audit rules. It seems that for 
Centos/RHEL 7 I need to put those into /etc/audit/rules.d/audit.rules 
and for Centos/RHEL6 (and probably Debian / Ubuntu?) it is 
/etc/audit/audit.rules.

I noticed however that at least on Centos 7 I could put my rules into 
/etc/audit/rules.d/plugin.rules and they will be picked on auditd 
restart and added to /etc/audit/audit.rules. This does not work on 
Debian 8 - even though it has ruled.d directory only rules from 
/rules.d/audit.rules are used.

Is there some kind of "official" guidance to where I should put my rules 
on Centos/RHEL/Debian/Ubuntu ?

-Lev

Re: audit rules placement

[Steve Grubb]

On Fri, 29 Jan 2016 12:37:31 +0200
Lev Stipakov <lstipakov@gmail.com> wrote:

> Hello,
> 
> I have a rpm/deb package which includes audisp plugin. In order
> plugin to work, I need to permanently add audit rules. It seems that
> for Centos/RHEL 7 I need to put those
> into  audit.rules and for Centos/RHEL6 (and
> probably Debian / Ubuntu?) it is /etc/audit/audit.rules.
> 
> I noticed however that at least on Centos 7 I could put my rules into 
> /etc/audit/rules.d/plugin.rules and they will be picked on auditd 
> restart and added to /etc/audit/audit.rules. This does not work on 
> Debian 8 - even though it has ruled.d directory only rules from 
> /rules.d/audit.rules are used.
> 
> Is there some kind of "official" guidance to where I should put my
> rules on Centos/RHEL/Debian/Ubuntu ?

/etc/audit/rules.d/ is where you should put rules for all recent audit
packages. You may need to advise them to enable augenrules. For
anything older, it needs to be inserted into audit.rules.

-Steve

> -Lev
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit