From mboxrd@z Thu Jan 1 00:00:00 1970 From: Richard Guy Briggs Subject: Re: Exclude Watched Items Date: Mon, 15 May 2017 23:22:38 -0400 Message-ID: <20170516032238.GP21241@madcap2.tricolour.ca> References: <3a9b11a79cc643ebb56c841a38b29846@XCGVAG30.northgrum.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <3a9b11a79cc643ebb56c841a38b29846@XCGVAG30.northgrum.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "Boyce, Kevin P [US] (AS)" Cc: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com On 2017-05-15 21:08, Boyce, Kevin P [US] (AS) wrote: > Ok I admit I should know how to do this, but it is evident I do not. > > On RHEL 5.11, what is the correct way for me to not audit anything in /proc? > > I had tried: > -d entry,always -S all -F dir=/proc > -a exclude,always -F dir=/proc > > Both of these are ignored. The first makes sense because I guess -d > must match exactly a rule already loaded in the kernel. "-d" says delete the rule. (I think the entry list is deprecated.) > The second is telling me I have an invalid message type, but I can't > seem to find the valid message types documented in the man pages. The exclude list only supports "-F msgtype=" on anything that old. More types are supported upstream and only very recent RHEL7. > Other systemcalls which are audited are open, fopen, chown, chattr, etc. > I am trying to prevent auditing of the open syscall on /proc/... > because there are a lot of them, and it is not a requirement. How about "-a exit,never -F dir=/proc"? > Kevin - RGB -- Richard Guy Briggs Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635