9:26 a.m.
I am required to place the following rule into my audit configurations, but
when I do auditd will stop loading rules from this particular rule forward
to the end.
-a always,exit -F path= /etc/NetworkManager/ -F perm=wa -F
key=system-locale
The rule immediately above it was:
-a exit,never -F dir=/usr/local/share/macrovision/storage -k exclude
If I hash out the syntax including NetworkManager all rules load, but
unhashed it stops loading rules from that point to the end.
--------------------------
Warron French
10:07 a.m.
On Thursday, July 8, 2021 10:26:57 AM EDT warron.french wrote:
I am required to place the following rule into my audit
configurations, but
when I do auditd will stop loading rules from this particular rule forward
to the end.
-a always,exit -F path= /etc/NetworkManager/ -F perm=wa -F
key=system-locale
There is a space between path= and /etc. Usually systemd puts auditctl
messages in syslog/journal.
-Steve
12:33 p.m.
Ah! that was a typo in my email typing, since I could not copy paste from
where the syntax was to my email I was typing.
Thanks Steve.
--------------------------
Warron French
On Thu, Jul 8, 2021 at 11:11 AM Steve Grubb <sgrubb(a)redhat.com> wrote:
On Thursday, July 8, 2021 10:26:57 AM EDT warron.french wrote:
> I am required to place the following rule into my audit configurations,
but
> when I do auditd will stop loading rules from this particular rule
forward
> to the end.
>
> -a always,exit -F path= /etc/NetworkManager/ -F perm=wa -F
> key=system-locale
There is a space between path= and /etc. Usually systemd puts auditctl
messages in syslog/journal.
-Steve
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
1:46 p.m.
On 2021-07-08 13:33, warron.french wrote:
Ah! that was a typo in my email typing, since I could not copy paste
from
where the syntax was to my email I was typing.
Could it be you are trying to add a directory with a path field?
Thanks Steve.
--------------------------
Warron French
On Thu, Jul 8, 2021 at 11:11 AM Steve Grubb <sgrubb(a)redhat.com> wrote:
> On Thursday, July 8, 2021 10:26:57 AM EDT warron.french wrote:
> > I am required to place the following rule into my audit configurations,
> but
> > when I do auditd will stop loading rules from this particular rule
> forward
> > to the end.
> >
> > -a always,exit -F path= /etc/NetworkManager/ -F perm=wa -F
> > key=system-locale
-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -F key=system-locale
> There is a space between path= and /etc. Usually systemd puts
auditctl
> messages in syslog/journal.
>
> -Steve
- RGB
--
Richard Guy Briggs <rgb(a)redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
2 p.m.
Yes!
--------------------------
Warron French
On Thu, Jul 8, 2021 at 2:47 PM Richard Guy Briggs <rgb(a)redhat.com> wrote:
On 2021-07-08 13:33, warron.french wrote:
> Ah! that was a typo in my email typing, since I could not copy paste from
> where the syntax was to my email I was typing.
Could it be you are trying to add a directory with a path field?
> Thanks Steve.
> --------------------------
> Warron French
>
> On Thu, Jul 8, 2021 at 11:11 AM Steve Grubb <sgrubb(a)redhat.com> wrote:
> > On Thursday, July 8, 2021 10:26:57 AM EDT warron.french wrote:
> > > I am required to place the following rule into my audit
configurations,
> > but
> > > when I do auditd will stop loading rules from this particular rule
> > forward
> > > to the end.
> > >
> > > -a always,exit -F path= /etc/NetworkManager/ -F perm=wa -F
> > > key=system-locale
-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -F key=system-locale
> > There is a space between path= and /etc. Usually systemd puts auditctl
> > messages in syslog/journal.
> >
> > -Steve
- RGB
--
Richard Guy Briggs <rgb(a)redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
2:05 p.m.
On Thursday, July 8, 2021 2:46:40 PM EDT Richard Guy Briggs wrote:
On 2021-07-08 13:33, warron.french wrote:
> Ah! that was a typo in my email typing, since I could not copy paste from
> where the syntax was to my email I was typing.
Could it be you are trying to add a directory with a path field?
That's not exactly a problem if you intend to watch the directory itself.
Placing a watch with dir does not actually include changes to entries in the
dirtectory itself, but rather the files contained by it.
-Steve
2:33 p.m.
Ok, thanks. I was supposed to use "dir=" though according to the rules
directed to me.
--------------------------
Warron French
On Thu, Jul 8, 2021 at 3:05 PM Steve Grubb <sgrubb(a)redhat.com> wrote:
On Thursday, July 8, 2021 2:46:40 PM EDT Richard Guy Briggs wrote:
> On 2021-07-08 13:33, warron.french wrote:
> > Ah! that was a typo in my email typing, since I could not copy paste
from
> > where the syntax was to my email I was typing.
>
> Could it be you are trying to add a directory with a path field?
That's not exactly a problem if you intend to watch the directory itself.
Placing a watch with dir does not actually include changes to entries in
the
dirtectory itself, but rather the files contained by it.
-Steve
1308
days inactive
1308
days old
linux-audit@lists.linux-audit.osci.io
6 comments
3 participants
participants (3)
-
Richard Guy Briggs -
Steve Grubb -
warron.french