Re: Audit rules keys
Henning, Arthur C. (CSL) wrote:
Using system-config-audit getting key (-k) configuration errors when
saving changes.
[root@localhost ~]# Stopping auditd: [ OK ]
Starting auditd: [ OK ]
key option needs a watch or syscall given prior to it
This is telling you that the -k flag needs to be after a -S
flag. I don't know why the order matters but apparently it does.
There was an error in line 9 of /etc/audit/audit.rules
cat /etc/audit/audit.rules
-e 1
-f 2
-b 8192
-r 0
-D
-a entry,always -S adjtimex -S settimeofday
-a entry,always -S clock_settime
-a entry,always -k kill -S kill
try:
-a entry, always -S kill -k kill
And for the rest, make the -k stuff to the end.
-a exit,always -k system-locale -S sethostname
-a exit,always -F exit=-13 -k creation -S creat -S mkdir -S mknod -S
link -S symlink
-a exit,always -F exit=-13 -k creation -S mkdirat -S mknodat -S linkat
-S symlinkat
If I remove the key from line 9 and save, get error reported line 10,
etc.
Started with NISPOM.rules contrib file.
Are the options in the wrong order in the contrib file too?
The draft I saw posted for comments was in the correct order
but I haven't looked at what's currently shipped.
-- ljk
Art Henning (CSL)
Enterprise IT Solutions
Northrop Grumman Corp
art.henning(a)ngc.com
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit