auditd is ignoring the -a rules
by fakie_flip from LinuxQuestions.org on (#545FZ)
The -a syscall rules aren't being shown by auditctl -l
Code:[plasma ~]# cat /etc/audit/rules.d/audit.rule
# -w path-to-file -p permissions -k keyname
# where the permission are any one of the following:
#
# r - read of the file
# w - write to the file
# x - execute the file
# a - change in the file's attribute (ownership/permissions)
-D # first rule - delete all
-w /etc/shadow -p wa -k shadow
-w /etc/passwd -p wa -k passwd
-w /etc/group -p wa -k group
-w /etc/sudoers -p wa -k sudoers
-w /etc/audit/rules.d/audit.rule -p rwxa -k rules
-w /etc/security -p rwxa -k security
-a always,exit -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -S clock_settime -k time-change
-a always,exit -S sethostname -S setdomainname -k system-locale
# disable adding any additional rules - note that adding new rules will require a reboot
-e 2
[plasma ~]# auditctl -R /etc/audit/rules.d/audit.rule
[plasma ~]# auditctl -l
-w /etc/shadow -p wa -k shadow
-w /etc/passwd -p wa -k passwd
-w /etc/group -p wa -k group
-w /etc/sudoers -p wa -k sudoers
-w /etc/audit/rules.d/audit.rule -p rwxa -k rules
-w /etc/security -p rwxa -k security
[plasma ~]#


Code:[plasma ~]# cat /etc/audit/rules.d/audit.rule
# -w path-to-file -p permissions -k keyname
# where the permission are any one of the following:
#
# r - read of the file
# w - write to the file
# x - execute the file
# a - change in the file's attribute (ownership/permissions)
-D # first rule - delete all
-w /etc/shadow -p wa -k shadow
-w /etc/passwd -p wa -k passwd
-w /etc/group -p wa -k group
-w /etc/sudoers -p wa -k sudoers
-w /etc/audit/rules.d/audit.rule -p rwxa -k rules
-w /etc/security -p rwxa -k security
-a always,exit -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -S clock_settime -k time-change
-a always,exit -S sethostname -S setdomainname -k system-locale
# disable adding any additional rules - note that adding new rules will require a reboot
-e 2
[plasma ~]# auditctl -R /etc/audit/rules.d/audit.rule
[plasma ~]# auditctl -l
-w /etc/shadow -p wa -k shadow
-w /etc/passwd -p wa -k passwd
-w /etc/group -p wa -k group
-w /etc/sudoers -p wa -k sudoers
-w /etc/audit/rules.d/audit.rule -p rwxa -k rules
-w /etc/security -p rwxa -k security
[plasma ~]#