Possible typo in 22-ignore-chrony.rules
- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
This snippit in both rules in that file (for both v2.8.5 and v3.0.0) "-F auid=unset
-Fuid=chrony" for the second "-F" seems to be missing a space after the
"-F". Correct?
IRT to the comment in this rule file, "These rules suppress the time-change event
when chrony does time updates"; does that mean IF these two rules were not included
or commented-out, that the chrony time updates would 'log' events in the audit
log?
How do these rules 'work' to suppress chrony time updates from being logged?
Thank you.
R,-Joe
Attachments:
- attachment.html (text/html — 1.1 KB)
On Sunday, January 17, 2021 11:42:38 PM EST Joe Wulf wrote:
This snippit in both rules in that file (for both v2.8.5 and v3.0.0)
"-F
auid=unset -Fuid=chrony" for the second "-F" seems to be missing a space
after the "-F". Correct?
Yeah, it looks that way. Fixed. Thanks!
IRT to the comment in this rule file, "These
rules suppress the time-change event when chrony does time updates"; does
that mean IF these two rules were not included or commented-out, that the
chrony time updates would 'log' events in the audit log?
Yes.
How do these rules 'work' to suppress chrony time updates
from being
logged?
The audit rules is a first match wins system. These rules are in a file with a
22 in the name which preceeds rules whose file name starts with 30. In 30-
stig.rules, we have a rule that asks for any use of adjtimex to be logged
which is the syscall chrony uses to update time. Since the rule in 22 has a
never action and it preceeds the one from the stig, it matches first and takes
the never action which is not to log it.
-Steve
1434
days inactive
1434
days old
linux-audit@lists.linux-audit.osci.io
1 comments
2 participants
tags (0)
participants (2)
-
Joe Wulf -
Steve Grubb