* Security audit rules @ 2019-11-08 12:52 Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) 2019-11-19 22:32 ` Richard Guy Briggs 0 siblings, 1 reply; 7+ messages in thread From: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) @ 2019-11-08 12:52 UTC (permalink / raw) To: linux-audit@redhat.com [-- Attachment #1.1: Type: text/plain, Size: 309 bytes --] Hi, In one of the VM I find audit.rules defined under /etc/audit as well as /etc/audit/rules.d. What is the significance as well as difference between the files found in 2 places. Also please let me know what is the correct location where audit.rules need to be places. Regards, Vezhavendan K [-- Attachment #1.2: Type: text/html, Size: 2755 bytes --] [-- Attachment #2: Type: text/plain, Size: 0 bytes --] ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Security audit rules 2019-11-08 12:52 Security audit rules Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) @ 2019-11-19 22:32 ` Richard Guy Briggs 2019-11-20 4:36 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) 0 siblings, 1 reply; 7+ messages in thread From: Richard Guy Briggs @ 2019-11-19 22:32 UTC (permalink / raw) To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai); +Cc: linux-audit@redhat.com On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) wrote: > Hi, > > In one of the VM I find audit.rules defined under /etc/audit as well as /etc/audit/rules.d. > > What is the significance as well as difference between the files found in 2 places. You haven't said what distro you are using. In more recent distros, the rules in rules.d are used by augenrules to populate audit.rules, overwriting them. > Also please let me know what is the correct location where audit.rules need to be places. Depends on your distro. > Vezhavendan K - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 ^ permalink raw reply [flat|nested] 7+ messages in thread
* RE: Security audit rules 2019-11-19 22:32 ` Richard Guy Briggs @ 2019-11-20 4:36 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) 2019-11-22 17:08 ` Steve Grubb 0 siblings, 1 reply; 7+ messages in thread From: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) @ 2019-11-20 4:36 UTC (permalink / raw) To: Richard Guy Briggs; +Cc: linux-audit@redhat.com I am using RHEL7.6 version (Red Hat Enterprise Linux 7 (Maipo)). Regards, Vezhavendan K -----Original Message----- From: Richard Guy Briggs <rgb@redhat.com> Sent: Wednesday, November 20, 2019 4:03 AM To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) <vezhavendan.1.kadirvadivelu.ext@nokia.com> Cc: linux-audit@redhat.com Subject: Re: Security audit rules On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) wrote: > Hi, > > In one of the VM I find audit.rules defined under /etc/audit as well as /etc/audit/rules.d. > > What is the significance as well as difference between the files found in 2 places. You haven't said what distro you are using. In more recent distros, the rules in rules.d are used by augenrules to populate audit.rules, overwriting them. > Also please let me know what is the correct location where audit.rules need to be places. Depends on your distro. > Vezhavendan K - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Security audit rules 2019-11-20 4:36 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) @ 2019-11-22 17:08 ` Steve Grubb 2019-11-24 6:44 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) 0 siblings, 1 reply; 7+ messages in thread From: Steve Grubb @ 2019-11-22 17:08 UTC (permalink / raw) To: linux-audit Cc: Richard Guy Briggs, Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) On Tuesday, November 19, 2019 11:36:38 PM EST Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) wrote: > I am using RHEL7.6 version (Red Hat Enterprise Linux 7 (Maipo)). This distribution wants rules placed in /etc/audit/rules.d/ The audit package should have a file named README-rules that explains what is expected. -Steve > -----Original Message----- > From: Richard Guy Briggs <rgb@redhat.com> > Sent: Wednesday, November 20, 2019 4:03 AM > To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) > <vezhavendan.1.kadirvadivelu.ext@nokia.com> Cc: linux-audit@redhat.com > Subject: Re: Security audit rules > > On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) wrote: > > Hi, > > > > In one of the VM I find audit.rules defined under /etc/audit as well as > > /etc/audit/rules.d. > > > > What is the significance as well as difference between the files found in > > 2 places. > You haven't said what distro you are using. In more recent distros, the > rules in rules.d are used by augenrules to populate audit.rules, > overwriting them. > > Also please let me know what is the correct location where audit.rules > > need to be places. > Depends on your distro. > > > Vezhavendan K > > - RGB > > -- > Richard Guy Briggs <rgb@redhat.com> > Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, > Red Hat Canada IRC: rgb, SunRaycer > Voice: +1.647.777.2635, Internal: (81) 32635 > > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit ^ permalink raw reply [flat|nested] 7+ messages in thread
* RE: Security audit rules 2019-11-22 17:08 ` Steve Grubb @ 2019-11-24 6:44 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) 2019-11-25 13:37 ` Steve Grubb 0 siblings, 1 reply; 7+ messages in thread From: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) @ 2019-11-24 6:44 UTC (permalink / raw) To: Steve Grubb, linux-audit@redhat.com; +Cc: Richard Guy Briggs That's clear on the rules. Thanks for that, but my question is where should I place the file called 'audit.rules'. It should be under '/etc/audit' or '/etc/audit/rules.d' or in both places. Regards, Vezhavendan K -----Original Message----- From: Steve Grubb <sgrubb@redhat.com> Sent: Friday, November 22, 2019 10:39 PM To: linux-audit@redhat.com Cc: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) <vezhavendan.1.kadirvadivelu.ext@nokia.com>; Richard Guy Briggs <rgb@redhat.com> Subject: Re: Security audit rules On Tuesday, November 19, 2019 11:36:38 PM EST Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) wrote: > I am using RHEL7.6 version (Red Hat Enterprise Linux 7 (Maipo)). This distribution wants rules placed in /etc/audit/rules.d/ The audit package should have a file named README-rules that explains what is expected. -Steve > -----Original Message----- > From: Richard Guy Briggs <rgb@redhat.com> > Sent: Wednesday, November 20, 2019 4:03 AM > To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) > <vezhavendan.1.kadirvadivelu.ext@nokia.com> Cc: linux-audit@redhat.com > Subject: Re: Security audit rules > > On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) wrote: > > Hi, > > > > In one of the VM I find audit.rules defined under /etc/audit as well > > as /etc/audit/rules.d. > > > > What is the significance as well as difference between the files > > found in > > 2 places. > You haven't said what distro you are using. In more recent distros, > the rules in rules.d are used by augenrules to populate audit.rules, > overwriting them. > > Also please let me know what is the correct location where > > audit.rules need to be places. > Depends on your distro. > > > Vezhavendan K > > - RGB > > -- > Richard Guy Briggs <rgb@redhat.com> > Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, > Ottawa, Red Hat Canada IRC: rgb, SunRaycer > Voice: +1.647.777.2635, Internal: (81) 32635 > > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Security audit rules 2019-11-24 6:44 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) @ 2019-11-25 13:37 ` Steve Grubb 2019-11-26 5:23 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) 0 siblings, 1 reply; 7+ messages in thread From: Steve Grubb @ 2019-11-25 13:37 UTC (permalink / raw) To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) Cc: Richard Guy Briggs, linux-audit@redhat.com On Sunday, November 24, 2019 1:44:03 AM EST Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) wrote: > That's clear on the rules. Thanks for that, but my question is where should > I place the file called 'audit.rules'. It should be under '/etc/audit' or > '/etc/audit/rules.d' or in both places. Nowhere. audit.rules is built by augenrules using the sorting method described in the man page for it. Again, there is a README-rules file that explains how this works. If you have specific things that you would like to add, then make a file for it and place it in /etc/audit/rules.d where it will get combined with other rule files. README-rules gives suggestions about how to name the file for predictable inclusion. -Steve > -----Original Message----- > From: Steve Grubb <sgrubb@redhat.com> > Sent: Friday, November 22, 2019 10:39 PM > To: linux-audit@redhat.com > Cc: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) > <vezhavendan.1.kadirvadivelu.ext@nokia.com>; Richard Guy Briggs > <rgb@redhat.com> Subject: Re: Security audit rules > > On Tuesday, November 19, 2019 11:36:38 PM EST Kadirvadivelu, Vezhavendan 1. > (EXT - IN/Chennai) wrote: > > I am using RHEL7.6 version (Red Hat Enterprise Linux 7 (Maipo)). > > This distribution wants rules placed in /etc/audit/rules.d/ The audit > package should have a file named README-rules that explains what is > expected. > > -Steve > > > -----Original Message----- > > From: Richard Guy Briggs <rgb@redhat.com> > > Sent: Wednesday, November 20, 2019 4:03 AM > > To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) > > <vezhavendan.1.kadirvadivelu.ext@nokia.com> Cc: linux-audit@redhat.com > > Subject: Re: Security audit rules > > > > On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) > > wrote: > > > Hi, > > > > > > In one of the VM I find audit.rules defined under /etc/audit as well > > > as /etc/audit/rules.d. > > > > > > What is the significance as well as difference between the files > > > found in > > > 2 places. > > > > You haven't said what distro you are using. In more recent distros, > > the rules in rules.d are used by augenrules to populate audit.rules, > > overwriting them. > > > > > Also please let me know what is the correct location where > > > audit.rules need to be places. > > > > Depends on your distro. > > > > > Vezhavendan K > > > > - RGB > > > > -- > > Richard Guy Briggs <rgb@redhat.com> > > Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, > > Ottawa, Red Hat Canada IRC: rgb, SunRaycer > > Voice: +1.647.777.2635, Internal: (81) 32635 > > > > > > -- > > Linux-audit mailing list > > Linux-audit@redhat.com > > https://www.redhat.com/mailman/listinfo/linux-audit ^ permalink raw reply [flat|nested] 7+ messages in thread
* RE: Security audit rules 2019-11-25 13:37 ` Steve Grubb @ 2019-11-26 5:23 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) 0 siblings, 0 replies; 7+ messages in thread From: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) @ 2019-11-26 5:23 UTC (permalink / raw) To: Steve Grubb; +Cc: Richard Guy Briggs, linux-audit@redhat.com Thanks Steve. That explains. Regards, Vezhavendan K -----Original Message----- From: Steve Grubb <sgrubb@redhat.com> Sent: Monday, November 25, 2019 7:08 PM To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) <vezhavendan.1.kadirvadivelu.ext@nokia.com> Cc: linux-audit@redhat.com; Richard Guy Briggs <rgb@redhat.com> Subject: Re: Security audit rules On Sunday, November 24, 2019 1:44:03 AM EST Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) wrote: > That's clear on the rules. Thanks for that, but my question is where > should I place the file called 'audit.rules'. It should be under > '/etc/audit' or '/etc/audit/rules.d' or in both places. Nowhere. audit.rules is built by augenrules using the sorting method described in the man page for it. Again, there is a README-rules file that explains how this works. If you have specific things that you would like to add, then make a file for it and place it in /etc/audit/rules.d where it will get combined with other rule files. README-rules gives suggestions about how to name the file for predictable inclusion. -Steve > -----Original Message----- > From: Steve Grubb <sgrubb@redhat.com> > Sent: Friday, November 22, 2019 10:39 PM > To: linux-audit@redhat.com > Cc: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) > <vezhavendan.1.kadirvadivelu.ext@nokia.com>; Richard Guy Briggs > <rgb@redhat.com> Subject: Re: Security audit rules > > On Tuesday, November 19, 2019 11:36:38 PM EST Kadirvadivelu, Vezhavendan 1. > (EXT - IN/Chennai) wrote: > > I am using RHEL7.6 version (Red Hat Enterprise Linux 7 (Maipo)). > > This distribution wants rules placed in /etc/audit/rules.d/ The audit > package should have a file named README-rules that explains what is > expected. > > -Steve > > > -----Original Message----- > > From: Richard Guy Briggs <rgb@redhat.com> > > Sent: Wednesday, November 20, 2019 4:03 AM > > To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) > > <vezhavendan.1.kadirvadivelu.ext@nokia.com> Cc: > > linux-audit@redhat.com > > Subject: Re: Security audit rules > > > > On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT - > > IN/Chennai) > > wrote: > > > Hi, > > > > > > In one of the VM I find audit.rules defined under /etc/audit as > > > well as /etc/audit/rules.d. > > > > > > What is the significance as well as difference between the files > > > found in > > > 2 places. > > > > You haven't said what distro you are using. In more recent distros, > > the rules in rules.d are used by augenrules to populate audit.rules, > > overwriting them. > > > > > Also please let me know what is the correct location where > > > audit.rules need to be places. > > > > Depends on your distro. > > > > > Vezhavendan K > > > > - RGB > > > > -- > > Richard Guy Briggs <rgb@redhat.com> > > Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, > > Ottawa, Red Hat Canada IRC: rgb, SunRaycer > > Voice: +1.647.777.2635, Internal: (81) 32635 > > > > > > -- > > Linux-audit mailing list > > Linux-audit@redhat.com > > https://www.redhat.com/mailman/listinfo/linux-audit ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2019-11-26 5:23 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2019-11-08 12:52 Security audit rules Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) 2019-11-19 22:32 ` Richard Guy Briggs 2019-11-20 4:36 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) 2019-11-22 17:08 ` Steve Grubb 2019-11-24 6:44 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) 2019-11-25 13:37 ` Steve Grubb 2019-11-26 5:23 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox