Re: audit rules placement
On Fri, 29 Jan 2016 12:37:31 +0200
Lev Stipakov <lstipakov(a)gmail.com> wrote:
Hello,
I have a rpm/deb package which includes audisp plugin. In order
plugin to work, I need to permanently add audit rules. It seems that
for Centos/RHEL 7 I need to put those
into audit.rules and for Centos/RHEL6 (and
probably Debian / Ubuntu?) it is /etc/audit/audit.rules.
I noticed however that at least on Centos 7 I could put my rules into
/etc/audit/rules.d/plugin.rules and they will be picked on auditd
restart and added to /etc/audit/audit.rules. This does not work on
Debian 8 - even though it has ruled.d directory only rules from
/rules.d/audit.rules are used.
Is there some kind of "official" guidance to where I should put my
rules on Centos/RHEL/Debian/Ubuntu ?
/etc/audit/rules.d/ is where you should put rules for all recent audit
packages. You may need to advise them to enable augenrules. For
anything older, it needs to be inserted into audit.rules.
-Steve
-Lev
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit