From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: audit rules placement Date: Fri, 29 Jan 2016 07:04:50 -0500 Message-ID: <20160129070450.32424e60@ivy-bridge> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Lev Stipakov Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Fri, 29 Jan 2016 12:37:31 +0200 Lev Stipakov wrote: > Hello, > > I have a rpm/deb package which includes audisp plugin. In order > plugin to work, I need to permanently add audit rules. It seems that > for Centos/RHEL 7 I need to put those > into audit.rules and for Centos/RHEL6 (and > probably Debian / Ubuntu?) it is /etc/audit/audit.rules. > > I noticed however that at least on Centos 7 I could put my rules into > /etc/audit/rules.d/plugin.rules and they will be picked on auditd > restart and added to /etc/audit/audit.rules. This does not work on > Debian 8 - even though it has ruled.d directory only rules from > /rules.d/audit.rules are used. > > Is there some kind of "official" guidance to where I should put my > rules on Centos/RHEL/Debian/Ubuntu ? /etc/audit/rules.d/ is where you should put rules for all recent audit packages. You may need to advise them to enable augenrules. For anything older, it needs to be inserted into audit.rules. -Steve > -Lev > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit