So,
Based on this and some experiments I have been performing, I would suggest changing how a lot of the FileSystem rules are written and illustrated.
The rule in the repository is
-a always,exit -F path=/etc/sudoers -F perm=wa -F key=10.2.2-priv-config-changes
My suggestion is to instead change the rule based on the permissions defined. The above rule would change to the following based on the kernel being used.
-a always,exit -S <list of syscalls in audit_write.h and audit_read.h +open,openat> -F path=/etc/sudoers -F perm=wa -F key=10.2.2-priv-config-changes
This is higher performance because we are limiting the syscalls instead of making use of -S all which has more paths of evaluation for each and every syscall.
Same thing for watches. Watches are inherently -S all rules which are very performance intensive.
Ideally we should limit the syscalls based on the permissions being used.
I have implemented the same in my environment rules and have noticed a massive performance difference with no difference in the events being logged since we anyways filter eventually based on the permissions.
Let me know what you all think.
Ali Adnan.