* Security audit rules
@ 2019-11-08 12:52 Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
2019-11-19 22:32 ` Richard Guy Briggs
0 siblings, 1 reply; 7+ messages in thread
From: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) @ 2019-11-08 12:52 UTC (permalink / raw)
To: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 309 bytes --]
Hi,
In one of the VM I find audit.rules defined under /etc/audit as well as /etc/audit/rules.d.
What is the significance as well as difference between the files found in 2 places.
Also please let me know what is the correct location where audit.rules need to be places.
Regards,
Vezhavendan K
[-- Attachment #1.2: Type: text/html, Size: 2755 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Security audit rules
2019-11-08 12:52 Security audit rules Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
@ 2019-11-19 22:32 ` Richard Guy Briggs
2019-11-20 4:36 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
0 siblings, 1 reply; 7+ messages in thread
From: Richard Guy Briggs @ 2019-11-19 22:32 UTC (permalink / raw)
To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai); +Cc: linux-audit
On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) wrote:
> Hi,
>
> In one of the VM I find audit.rules defined under /etc/audit as well as /etc/audit/rules.d.
>
> What is the significance as well as difference between the files found in 2 places.
You haven't said what distro you are using. In more recent distros, the
rules in rules.d are used by augenrules to populate audit.rules,
overwriting them.
> Also please let me know what is the correct location where audit.rules need to be places.
Depends on your distro.
> Vezhavendan K
- RGB
--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
^ permalink raw reply [flat|nested] 7+ messages in thread
* RE: Security audit rules
2019-11-19 22:32 ` Richard Guy Briggs
@ 2019-11-20 4:36 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
2019-11-22 17:08 ` Steve Grubb
0 siblings, 1 reply; 7+ messages in thread
From: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) @ 2019-11-20 4:36 UTC (permalink / raw)
To: Richard Guy Briggs; +Cc: linux-audit
I am using RHEL7.6 version (Red Hat Enterprise Linux 7 (Maipo)).
Regards,
Vezhavendan K
-----Original Message-----
From: Richard Guy Briggs <rgb@redhat.com>
Sent: Wednesday, November 20, 2019 4:03 AM
To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) <vezhavendan.1.kadirvadivelu.ext@nokia.com>
Cc: linux-audit@redhat.com
Subject: Re: Security audit rules
On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) wrote:
> Hi,
>
> In one of the VM I find audit.rules defined under /etc/audit as well as /etc/audit/rules.d.
>
> What is the significance as well as difference between the files found in 2 places.
You haven't said what distro you are using. In more recent distros, the rules in rules.d are used by augenrules to populate audit.rules, overwriting them.
> Also please let me know what is the correct location where audit.rules need to be places.
Depends on your distro.
> Vezhavendan K
- RGB
--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Security audit rules
2019-11-20 4:36 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
@ 2019-11-22 17:08 ` Steve Grubb
2019-11-24 6:44 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
0 siblings, 1 reply; 7+ messages in thread
From: Steve Grubb @ 2019-11-22 17:08 UTC (permalink / raw)
To: linux-audit
Cc: Richard Guy Briggs, Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
On Tuesday, November 19, 2019 11:36:38 PM EST Kadirvadivelu, Vezhavendan 1.
(EXT - IN/Chennai) wrote:
> I am using RHEL7.6 version (Red Hat Enterprise Linux 7 (Maipo)).
This distribution wants rules placed in /etc/audit/rules.d/
The audit package should have a file named README-rules that explains what is
expected.
-Steve
> -----Original Message-----
> From: Richard Guy Briggs <rgb@redhat.com>
> Sent: Wednesday, November 20, 2019 4:03 AM
> To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
> <vezhavendan.1.kadirvadivelu.ext@nokia.com> Cc: linux-audit@redhat.com
> Subject: Re: Security audit rules
>
> On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
wrote:
> > Hi,
> >
> > In one of the VM I find audit.rules defined under /etc/audit as well as
> > /etc/audit/rules.d.
> >
> > What is the significance as well as difference between the files found in
> > 2 places.
> You haven't said what distro you are using. In more recent distros, the
> rules in rules.d are used by augenrules to populate audit.rules,
> overwriting them.
> > Also please let me know what is the correct location where audit.rules
> > need to be places.
> Depends on your distro.
>
> > Vezhavendan K
>
> - RGB
>
> --
> Richard Guy Briggs <rgb@redhat.com>
> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa,
> Red Hat Canada IRC: rgb, SunRaycer
> Voice: +1.647.777.2635, Internal: (81) 32635
>
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 7+ messages in thread
* RE: Security audit rules
2019-11-22 17:08 ` Steve Grubb
@ 2019-11-24 6:44 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
2019-11-25 13:37 ` Steve Grubb
0 siblings, 1 reply; 7+ messages in thread
From: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) @ 2019-11-24 6:44 UTC (permalink / raw)
To: Steve Grubb, linux-audit; +Cc: Richard Guy Briggs
That's clear on the rules. Thanks for that, but my question is where should I place the file called 'audit.rules'. It should be under '/etc/audit' or '/etc/audit/rules.d' or in both places.
Regards,
Vezhavendan K
-----Original Message-----
From: Steve Grubb <sgrubb@redhat.com>
Sent: Friday, November 22, 2019 10:39 PM
To: linux-audit@redhat.com
Cc: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) <vezhavendan.1.kadirvadivelu.ext@nokia.com>; Richard Guy Briggs <rgb@redhat.com>
Subject: Re: Security audit rules
On Tuesday, November 19, 2019 11:36:38 PM EST Kadirvadivelu, Vezhavendan 1.
(EXT - IN/Chennai) wrote:
> I am using RHEL7.6 version (Red Hat Enterprise Linux 7 (Maipo)).
This distribution wants rules placed in /etc/audit/rules.d/ The audit package should have a file named README-rules that explains what is expected.
-Steve
> -----Original Message-----
> From: Richard Guy Briggs <rgb@redhat.com>
> Sent: Wednesday, November 20, 2019 4:03 AM
> To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
> <vezhavendan.1.kadirvadivelu.ext@nokia.com> Cc: linux-audit@redhat.com
> Subject: Re: Security audit rules
>
> On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
wrote:
> > Hi,
> >
> > In one of the VM I find audit.rules defined under /etc/audit as well
> > as /etc/audit/rules.d.
> >
> > What is the significance as well as difference between the files
> > found in
> > 2 places.
> You haven't said what distro you are using. In more recent distros,
> the rules in rules.d are used by augenrules to populate audit.rules,
> overwriting them.
> > Also please let me know what is the correct location where
> > audit.rules need to be places.
> Depends on your distro.
>
> > Vezhavendan K
>
> - RGB
>
> --
> Richard Guy Briggs <rgb@redhat.com>
> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote,
> Ottawa, Red Hat Canada IRC: rgb, SunRaycer
> Voice: +1.647.777.2635, Internal: (81) 32635
>
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Security audit rules
2019-11-24 6:44 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
@ 2019-11-25 13:37 ` Steve Grubb
2019-11-26 5:23 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
0 siblings, 1 reply; 7+ messages in thread
From: Steve Grubb @ 2019-11-25 13:37 UTC (permalink / raw)
To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
Cc: Richard Guy Briggs, linux-audit
On Sunday, November 24, 2019 1:44:03 AM EST Kadirvadivelu, Vezhavendan 1.
(EXT - IN/Chennai) wrote:
> That's clear on the rules. Thanks for that, but my question is where should
> I place the file called 'audit.rules'. It should be under '/etc/audit' or
> '/etc/audit/rules.d' or in both places.
Nowhere. audit.rules is built by augenrules using the sorting method
described in the man page for it. Again, there is a README-rules file that
explains how this works. If you have specific things that you would like to
add, then make a file for it and place it in /etc/audit/rules.d where it will
get combined with other rule files. README-rules gives suggestions about how
to name the file for predictable inclusion.
-Steve
> -----Original Message-----
> From: Steve Grubb <sgrubb@redhat.com>
> Sent: Friday, November 22, 2019 10:39 PM
> To: linux-audit@redhat.com
> Cc: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
> <vezhavendan.1.kadirvadivelu.ext@nokia.com>; Richard Guy Briggs
> <rgb@redhat.com> Subject: Re: Security audit rules
>
> On Tuesday, November 19, 2019 11:36:38 PM EST Kadirvadivelu, Vezhavendan 1.
> (EXT - IN/Chennai) wrote:
> > I am using RHEL7.6 version (Red Hat Enterprise Linux 7 (Maipo)).
>
> This distribution wants rules placed in /etc/audit/rules.d/ The audit
> package should have a file named README-rules that explains what is
> expected.
>
> -Steve
>
> > -----Original Message-----
> > From: Richard Guy Briggs <rgb@redhat.com>
> > Sent: Wednesday, November 20, 2019 4:03 AM
> > To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
> > <vezhavendan.1.kadirvadivelu.ext@nokia.com> Cc: linux-audit@redhat.com
> > Subject: Re: Security audit rules
> >
> > On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
>
> wrote:
> > > Hi,
> > >
> > > In one of the VM I find audit.rules defined under /etc/audit as well
> > > as /etc/audit/rules.d.
> > >
> > > What is the significance as well as difference between the files
> > > found in
> > > 2 places.
> >
> > You haven't said what distro you are using. In more recent distros,
> > the rules in rules.d are used by augenrules to populate audit.rules,
> > overwriting them.
> >
> > > Also please let me know what is the correct location where
> > > audit.rules need to be places.
> >
> > Depends on your distro.
> >
> > > Vezhavendan K
> >
> > - RGB
> >
> > --
> > Richard Guy Briggs <rgb@redhat.com>
> > Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote,
> > Ottawa, Red Hat Canada IRC: rgb, SunRaycer
> > Voice: +1.647.777.2635, Internal: (81) 32635
> >
> >
> > --
> > Linux-audit mailing list
> > Linux-audit@redhat.com
> > https://www.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 7+ messages in thread
* RE: Security audit rules
2019-11-25 13:37 ` Steve Grubb
@ 2019-11-26 5:23 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
0 siblings, 0 replies; 7+ messages in thread
From: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) @ 2019-11-26 5:23 UTC (permalink / raw)
To: Steve Grubb; +Cc: Richard Guy Briggs, linux-audit
Thanks Steve. That explains.
Regards,
Vezhavendan K
-----Original Message-----
From: Steve Grubb <sgrubb@redhat.com>
Sent: Monday, November 25, 2019 7:08 PM
To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) <vezhavendan.1.kadirvadivelu.ext@nokia.com>
Cc: linux-audit@redhat.com; Richard Guy Briggs <rgb@redhat.com>
Subject: Re: Security audit rules
On Sunday, November 24, 2019 1:44:03 AM EST Kadirvadivelu, Vezhavendan 1.
(EXT - IN/Chennai) wrote:
> That's clear on the rules. Thanks for that, but my question is where
> should I place the file called 'audit.rules'. It should be under
> '/etc/audit' or '/etc/audit/rules.d' or in both places.
Nowhere. audit.rules is built by augenrules using the sorting method described in the man page for it. Again, there is a README-rules file that explains how this works. If you have specific things that you would like to add, then make a file for it and place it in /etc/audit/rules.d where it will get combined with other rule files. README-rules gives suggestions about how to name the file for predictable inclusion.
-Steve
> -----Original Message-----
> From: Steve Grubb <sgrubb@redhat.com>
> Sent: Friday, November 22, 2019 10:39 PM
> To: linux-audit@redhat.com
> Cc: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
> <vezhavendan.1.kadirvadivelu.ext@nokia.com>; Richard Guy Briggs
> <rgb@redhat.com> Subject: Re: Security audit rules
>
> On Tuesday, November 19, 2019 11:36:38 PM EST Kadirvadivelu, Vezhavendan 1.
> (EXT - IN/Chennai) wrote:
> > I am using RHEL7.6 version (Red Hat Enterprise Linux 7 (Maipo)).
>
> This distribution wants rules placed in /etc/audit/rules.d/ The audit
> package should have a file named README-rules that explains what is
> expected.
>
> -Steve
>
> > -----Original Message-----
> > From: Richard Guy Briggs <rgb@redhat.com>
> > Sent: Wednesday, November 20, 2019 4:03 AM
> > To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
> > <vezhavendan.1.kadirvadivelu.ext@nokia.com> Cc:
> > linux-audit@redhat.com
> > Subject: Re: Security audit rules
> >
> > On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT -
> > IN/Chennai)
>
> wrote:
> > > Hi,
> > >
> > > In one of the VM I find audit.rules defined under /etc/audit as
> > > well as /etc/audit/rules.d.
> > >
> > > What is the significance as well as difference between the files
> > > found in
> > > 2 places.
> >
> > You haven't said what distro you are using. In more recent distros,
> > the rules in rules.d are used by augenrules to populate audit.rules,
> > overwriting them.
> >
> > > Also please let me know what is the correct location where
> > > audit.rules need to be places.
> >
> > Depends on your distro.
> >
> > > Vezhavendan K
> >
> > - RGB
> >
> > --
> > Richard Guy Briggs <rgb@redhat.com>
> > Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote,
> > Ottawa, Red Hat Canada IRC: rgb, SunRaycer
> > Voice: +1.647.777.2635, Internal: (81) 32635
> >
> >
> > --
> > Linux-audit mailing list
> > Linux-audit@redhat.com
> > https://www.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2019-11-26 5:23 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-08 12:52 Security audit rules Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
2019-11-19 22:32 ` Richard Guy Briggs
2019-11-20 4:36 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
2019-11-22 17:08 ` Steve Grubb
2019-11-24 6:44 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
2019-11-25 13:37 ` Steve Grubb
2019-11-26 5:23 ` Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.