Article 545FZ auditd is ignoring the -a rules

auditd is ignoring the -a rules

by
fakie_flip
from LinuxQuestions.org on (#545FZ)
The -a syscall rules aren't being shown by auditctl -l

Code:[plasma ~]# cat /etc/audit/rules.d/audit.rule
# -w path-to-file -p permissions -k keyname
# where the permission are any one of the following:
#
# r - read of the file
# w - write to the file
# x - execute the file
# a - change in the file's attribute (ownership/permissions)
-D # first rule - delete all
-w /etc/shadow -p wa -k shadow
-w /etc/passwd -p wa -k passwd
-w /etc/group -p wa -k group
-w /etc/sudoers -p wa -k sudoers
-w /etc/audit/rules.d/audit.rule -p rwxa -k rules
-w /etc/security -p rwxa -k security
-a always,exit -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -S clock_settime -k time-change
-a always,exit -S sethostname -S setdomainname -k system-locale
# disable adding any additional rules - note that adding new rules will require a reboot
-e 2
[plasma ~]# auditctl -R /etc/audit/rules.d/audit.rule
[plasma ~]# auditctl -l
-w /etc/shadow -p wa -k shadow
-w /etc/passwd -p wa -k passwd
-w /etc/group -p wa -k group
-w /etc/sudoers -p wa -k sudoers
-w /etc/audit/rules.d/audit.rule -p rwxa -k rules
-w /etc/security -p rwxa -k security
[plasma ~]#latest?d=yIl2AUoC8zA latest?i=uUxyNv6XHjg:QbAqhrTdCW0:F7zBnMy latest?i=uUxyNv6XHjg:QbAqhrTdCW0:V_sGLiP latest?d=qj6IDK7rITs latest?i=uUxyNv6XHjg:QbAqhrTdCW0:gIN9vFwuUxyNv6XHjg
External Content
Source RSS or Atom Feed
Feed Location https://feeds.feedburner.com/linuxquestions/latest
Feed Title LinuxQuestions.org
Feed Link https://www.linuxquestions.org/questions/
Reply 0 comments