audit.rules file [Was: audit 2.3 released]

Hi,

Several people have asked for a way to deposit rules into a directory so that based on what is installed, rules can also be added. This makes it easier to have a core system that gets packages, config, and files added to make it a different kind of server or desktop. My guess is that it will be mostly used to add watches on setuid apps which can differ from machine type to machine type. The place where these rules are stored is /etc/audit/rules.d. Compiling rules from that directory will result in a new file being written to /etc/audit/audit.rules. That means it can overwrite existing rules. Since we don't want that to happen by accident, augenrules is disabled by default.