From mboxrd@z Thu Jan 1 00:00:00 1970 From: Linda Knippers Subject: Re: Audit rules keys Date: Tue, 21 Aug 2007 11:39:51 -0400 Message-ID: <46CB0747.6020203@hp.com> References: <6F2A8C9C4C5BE446A17B745BBC856EEB5A6D39@XMBTX113.northgrum.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l7LFj9PU027390 for ; Tue, 21 Aug 2007 11:45:09 -0400 Received: from tayrelbas04.tay.hp.com (tayrelbas04.tay.hp.com [161.114.80.247]) by mx1.redhat.com (8.13.1/8.13.1) with ESMTP id l7LFj83d016009 for ; Tue, 21 Aug 2007 11:45:08 -0400 In-Reply-To: <6F2A8C9C4C5BE446A17B745BBC856EEB5A6D39@XMBTX113.northgrum.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "Henning, Arthur C. (CSL)" Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com Henning, Arthur C. (CSL) wrote: > Using system-config-audit getting key (-k) configuration errors when > saving changes. > > [root@localhost ~]# Stopping auditd: [ OK ] > Starting auditd: [ OK ] > key option needs a watch or syscall given prior to it This is telling you that the -k flag needs to be after a -S flag. I don't know why the order matters but apparently it does. > There was an error in line 9 of /etc/audit/audit.rules > cat /etc/audit/audit.rules > -e 1 > -f 2 > -b 8192 > -r 0 > > -D > -a entry,always -S adjtimex -S settimeofday > -a entry,always -S clock_settime > -a entry,always -k kill -S kill try: -a entry, always -S kill -k kill And for the rest, make the -k stuff to the end. > -a exit,always -k system-locale -S sethostname > -a exit,always -F exit=-13 -k creation -S creat -S mkdir -S mknod -S > link -S symlink > -a exit,always -F exit=-13 -k creation -S mkdirat -S mknodat -S linkat > -S symlinkat > > If I remove the key from line 9 and save, get error reported line 10, > etc. > > Started with NISPOM.rules contrib file. Are the options in the wrong order in the contrib file too? The draft I saw posted for comments was in the correct order but I haven't looked at what's currently shipped. -- ljk > > Art Henning (CSL) > Enterprise IT Solutions > Northrop Grumman Corp > art.henning@ngc.com > > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit