Security audit rules

[Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)]

Thanks Steve. That explains.

Regards,
Vezhavendan K

-----Original Message-----
From: Steve Grubb <sgrubb at redhat.com> 
Sent: Monday, November 25, 2019 7:08 PM
To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) <vezhavendan.1.kadirvadivelu.ext at nokia.com>
Cc: linux-audit at redhat.com; Richard Guy Briggs <rgb at redhat.com>
Subject: Re: Security audit rules

On Sunday, November 24, 2019 1:44:03 AM EST Kadirvadivelu, Vezhavendan 1. 
(EXT - IN/Chennai) wrote:
> That's clear on the rules. Thanks for that, but my question is where 
> should I place the file called 'audit.rules'. It should be under 
> '/etc/audit' or '/etc/audit/rules.d' or in both places.

Nowhere. audit.rules is built by augenrules using the sorting method described in the man page for it. Again, there is a README-rules file that explains how this works. If you have specific things that you would like to add, then make a file for it and place it in /etc/audit/rules.d where it will get combined with other rule files. README-rules gives suggestions about how to name the file for predictable inclusion.

-Steve


> -----Original Message-----
> From: Steve Grubb <sgrubb at redhat.com>
> Sent: Friday, November 22, 2019 10:39 PM
> To: linux-audit at redhat.com
> Cc: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) 
> <vezhavendan.1.kadirvadivelu.ext at nokia.com>; Richard Guy Briggs 
> <rgb at redhat.com> Subject: Re: Security audit rules
> 
> On Tuesday, November 19, 2019 11:36:38 PM EST Kadirvadivelu, Vezhavendan 1.
> (EXT - IN/Chennai) wrote:
> > I am using RHEL7.6 version (Red Hat Enterprise Linux 7 (Maipo)).
> 
> This distribution wants rules placed in /etc/audit/rules.d/ The audit 
> package should have a file named README-rules that explains what is 
> expected.
> 
> -Steve
> 
> > -----Original Message-----
> > From: Richard Guy Briggs <rgb at redhat.com>
> > Sent: Wednesday, November 20, 2019 4:03 AM
> > To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) 
> > <vezhavendan.1.kadirvadivelu.ext at nokia.com> Cc: 
> > linux-audit at redhat.com
> > Subject: Re: Security audit rules
> > 
> > On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT - 
> > IN/Chennai)
> 
> wrote:
> > > Hi,
> > > 
> > > In one of the VM I find audit.rules defined under /etc/audit as 
> > > well as /etc/audit/rules.d.
> > > 
> > > What is the significance as well as difference between the files 
> > > found in
> > > 2 places.
> > 
> > You haven't said what distro you are using.  In more recent distros, 
> > the rules in rules.d are used by augenrules to populate audit.rules, 
> > overwriting them.
> > 
> > > Also please let me know what is the correct location where 
> > > audit.rules need to be places.
> > 
> > Depends on your distro.
> > 
> > > Vezhavendan K
> > 
> > - RGB
> > 
> > --
> > Richard Guy Briggs <rgb at redhat.com>
> > Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, 
> > Ottawa, Red Hat Canada IRC: rgb, SunRaycer
> > Voice: +1.647.777.2635, Internal: (81) 32635
> > 
> > 
> > --
> > Linux-audit mailing list
> > Linux-audit at redhat.com
> > https://www.redhat.com/mailman/listinfo/linux-audit