From mboxrd@z Thu Jan  1 00:00:00 1970
From: Lev Stipakov <lstipakov@gmail.com>
Subject: audit rules placement
Date: Fri, 29 Jan 2016 12:37:31 +0200
Message-ID: <n8ffdb$ttl$1@ger.gmane.org>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (ext-mx06.extmail.prod.ext.phx2.redhat.com
	[10.5.110.30])
	by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP
	id u0TAr2Yl019517
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256
	verify=NO)
	for <linux-audit@redhat.com>; Fri, 29 Jan 2016 05:53:02 -0500
Received: from plane.gmane.org (plane.gmane.org [80.91.229.3])
	by mx1.redhat.com (Postfix) with ESMTPS id 5639D3B70B
	for <linux-audit@redhat.com>; Fri, 29 Jan 2016 10:53:01 +0000 (UTC)
Received: from list by plane.gmane.org with local (Exim 4.69)
	(envelope-from <glrsa-linux-audit@m.gmane.org>) id 1aP6Qt-0006Hq-PE
	for linux-audit@redhat.com; Fri, 29 Jan 2016 11:37:49 +0100
Received: from 194.100.33.82 ([194.100.33.82])
	by main.gmane.org with esmtp (Gmexim 0.1 (Debian))
	id 1AlnuQ-0007hv-00
	for <linux-audit@redhat.com>; Fri, 29 Jan 2016 11:37:39 +0100
Received: from lstipakov by 194.100.33.82 with local (Gmexim 0.1 (Debian))
	id 1AlnuQ-0007hv-00
	for <linux-audit@redhat.com>; Fri, 29 Jan 2016 11:37:39 +0100
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

Hello,

I have a rpm/deb package which includes audisp plugin. In order plugin 
to work, I need to permanently add audit rules. It seems that for 
Centos/RHEL 7 I need to put those into /etc/audit/rules.d/audit.rules 
and for Centos/RHEL6 (and probably Debian / Ubuntu?) it is 
/etc/audit/audit.rules.

I noticed however that at least on Centos 7 I could put my rules into 
/etc/audit/rules.d/plugin.rules and they will be picked on auditd 
restart and added to /etc/audit/audit.rules. This does not work on 
Debian 8 - even though it has ruled.d directory only rules from 
/rules.d/audit.rules are used.

Is there some kind of "official" guidance to where I should put my rules 
on Centos/RHEL/Debian/Ubuntu ?

-Lev