From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Security audit rules Date: Mon, 25 Nov 2019 08:37:53 -0500 Message-ID: <2921353.XK4XxU5UnF@x2> References: <2526162.J9WsBpnIYZ@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)" Cc: Richard Guy Briggs , "linux-audit@redhat.com" List-Id: linux-audit@redhat.com On Sunday, November 24, 2019 1:44:03 AM EST Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) wrote: > That's clear on the rules. Thanks for that, but my question is where should > I place the file called 'audit.rules'. It should be under '/etc/audit' or > '/etc/audit/rules.d' or in both places. Nowhere. audit.rules is built by augenrules using the sorting method described in the man page for it. Again, there is a README-rules file that explains how this works. If you have specific things that you would like to add, then make a file for it and place it in /etc/audit/rules.d where it will get combined with other rule files. README-rules gives suggestions about how to name the file for predictable inclusion. -Steve > -----Original Message----- > From: Steve Grubb > Sent: Friday, November 22, 2019 10:39 PM > To: linux-audit@redhat.com > Cc: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) > ; Richard Guy Briggs > Subject: Re: Security audit rules > > On Tuesday, November 19, 2019 11:36:38 PM EST Kadirvadivelu, Vezhavendan 1. > (EXT - IN/Chennai) wrote: > > I am using RHEL7.6 version (Red Hat Enterprise Linux 7 (Maipo)). > > This distribution wants rules placed in /etc/audit/rules.d/ The audit > package should have a file named README-rules that explains what is > expected. > > -Steve > > > -----Original Message----- > > From: Richard Guy Briggs > > Sent: Wednesday, November 20, 2019 4:03 AM > > To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) > > Cc: linux-audit@redhat.com > > Subject: Re: Security audit rules > > > > On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) > > wrote: > > > Hi, > > > > > > In one of the VM I find audit.rules defined under /etc/audit as well > > > as /etc/audit/rules.d. > > > > > > What is the significance as well as difference between the files > > > found in > > > 2 places. > > > > You haven't said what distro you are using. In more recent distros, > > the rules in rules.d are used by augenrules to populate audit.rules, > > overwriting them. > > > > > Also please let me know what is the correct location where > > > audit.rules need to be places. > > > > Depends on your distro. > > > > > Vezhavendan K > > > > - RGB > > > > -- > > Richard Guy Briggs > > Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, > > Ottawa, Red Hat Canada IRC: rgb, SunRaycer > > Voice: +1.647.777.2635, Internal: (81) 32635 > > > > > > -- > > Linux-audit mailing list > > Linux-audit@redhat.com > > https://www.redhat.com/mailman/listinfo/linux-audit