* Duplicate Rule situation
@ 2021-06-21 16:52 warron.french
2021-06-21 16:57 ` Richard Guy Briggs
0 siblings, 1 reply; 2+ messages in thread
From: warron.french @ 2021-06-21 16:52 UTC (permalink / raw)
To: Linux Audit
[-- Attachment #1.1: Type: text/plain, Size: 343 bytes --]
Does anybody know if I put the following two rules into the same
audit.rules file and reboot the server will we end up with some broken
rules?
-w /etc/audit/ -p a -k watch_audit
-w /etc/audit/rules.d/ -p a -k watch_audit
Will this cause a problem due to duplicate rules?
--------------------------
Warron French
[-- Attachment #1.2: Type: text/html, Size: 690 bytes --]
[-- Attachment #2: Type: text/plain, Size: 106 bytes --]
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Duplicate Rule situation
2021-06-21 16:52 Duplicate Rule situation warron.french
@ 2021-06-21 16:57 ` Richard Guy Briggs
0 siblings, 0 replies; 2+ messages in thread
From: Richard Guy Briggs @ 2021-06-21 16:57 UTC (permalink / raw)
To: warron.french; +Cc: Linux Audit
On 2021-06-21 12:52, warron.french wrote:
> Does anybody know if I put the following two rules into the same
> audit.rules file and reboot the server will we end up with some broken
> rules?
>
> -w /etc/audit/ -p a -k watch_audit
> -w /etc/audit/rules.d/ -p a -k watch_audit
>
> Will this cause a problem due to duplicate rules?
These are two distinct rules, but redundant, so there won't be any
conflict, but the second rule will never trigger.
If you want finer grained triggering under one rule, likely with a
different key, try instead something like:
-w /etc/audit/rules.d/ -p a -k watch_audit_rules_d
-w /etc/audit/ -p a -k watch_audit
> Warron French
- RGB
--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-06-21 16:57 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-06-21 16:52 Duplicate Rule situation warron.french
2021-06-21 16:57 ` Richard Guy Briggs
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.