From mboxrd@z Thu Jan 1 00:00:00 1970 From: Warron S French Subject: audit.rules setting Date: Tue, 22 Mar 2016 12:55:25 +0000 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============5198334144604270873==" Return-path: Received: from mx1.redhat.com (ext-mx05.extmail.prod.ext.phx2.redhat.com [10.5.110.29]) by int-mx14.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u2MCtnkb008707 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Tue, 22 Mar 2016 08:55:49 -0400 Received: from email3-east.aero.org (email3-east.aero.org [130.221.184.167]) by mx1.redhat.com (Postfix) with ESMTPS id 4961B461C3 for ; Tue, 22 Mar 2016 12:55:48 +0000 (UTC) Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============5198334144604270873== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_BY1PR09MB0887F3A8E6CB06578182DF97C7800BY1PR09MB0887namp_" --_000_BY1PR09MB0887F3A8E6CB06578182DF97C7800BY1PR09MB0887namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Does the "-e 2" have to be the last line of the audit.rules file? Does it have to be listed prior to all of the syscalls and watches configur= ed in the file? Thank you in advance, Warron French, MBA, SCSA --_000_BY1PR09MB0887F3A8E6CB06578182DF97C7800BY1PR09MB0887namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Does the “–e 2” have to be the las= t line of the audit.rules file?

Does it have to be listed prior to all of the syscal= ls and watches configured in the file?

 

 

Thank you in advance,

 

Warron French, MBA, SCSA

--_000_BY1PR09MB0887F3A8E6CB06578182DF97C7800BY1PR09MB0887namp_-- --===============5198334144604270873== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============5198334144604270873==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: audit.rules setting Date: Tue, 22 Mar 2016 10:06:07 -0400 Message-ID: <3733418.XMMLLTDFfX@x2> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday, March 22, 2016 12:55:25 PM Warron S French wrote: > Does the "-e 2" have to be the last line of the audit.rules file? Yes. Once its sent to the kernel, the kernel rules tables are immutable. > Does it have to be listed prior to all of the syscalls and watches > configured in the file? No. This will make it not load anything. -Steve From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Boyce, Kevin P (AS)" Subject: RE: EXT :Re: audit.rules setting Date: Tue, 22 Mar 2016 14:26:33 +0000 Message-ID: References: <3733418.XMMLLTDFfX@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <3733418.XMMLLTDFfX@x2> Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb , "linux-audit@redhat.com" List-Id: linux-audit@redhat.com With regard to this subject I don't know if it is possible, but it bothers me when shutting down a system that you get errors (when -e 2 is enabled) when auditd is stopping. That might be unavoidable though. Kevin Boyce -----Original Message----- From: linux-audit-bounces@redhat.com [mailto:linux-audit-bounces@redhat.com] On Behalf Of Steve Grubb Sent: Tuesday, March 22, 2016 10:06 AM To: linux-audit@redhat.com Subject: EXT :Re: audit.rules setting On Tuesday, March 22, 2016 12:55:25 PM Warron S French wrote: > Does the "-e 2" have to be the last line of the audit.rules file? Yes. Once its sent to the kernel, the kernel rules tables are immutable. > Does it have to be listed prior to all of the syscalls and watches > configured in the file? No. This will make it not load anything. -Steve -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: EXT :Re: audit.rules setting Date: Tue, 22 Mar 2016 10:40:42 -0400 Message-ID: <2807952.R0hKEWZBSv@x2> References: <3733418.XMMLLTDFfX@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "Boyce, Kevin P (AS)" Cc: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com On Tuesday, March 22, 2016 02:26:33 PM Boyce, Kevin P wrote: > With regard to this subject I don't know if it is possible, but it bothers > me when shutting down a system that you get errors (when -e 2 is enabled) > when auditd is stopping. That might be unavoidable though. If this is a sysVinit system, then there are variables in /etc/sysconfig/auditd such as AUDITD_CLEAN_STOP that determine what the init script does. If you have a systemd based init system, then by default it does not modify rules like the sysVinit one does. It does have a ExecStopPost= variable that can be modified if you wanted to clear rules on shutdown. -Steve > -----Original Message----- > From: linux-audit-bounces@redhat.com [mailto:linux-audit-bounces@redhat.com] > On Behalf Of Steve Grubb Sent: Tuesday, March 22, 2016 10:06 AM > To: linux-audit@redhat.com > Subject: EXT :Re: audit.rules setting > > On Tuesday, March 22, 2016 12:55:25 PM Warron S French wrote: > > Does the "-e 2" have to be the last line of the audit.rules file? > > Yes. Once its sent to the kernel, the kernel rules tables are immutable. > > > Does it have to be listed prior to all of the syscalls and watches > > configured in the file? > > No. This will make it not load anything. > > -Steve > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit