archive mirror
 help / color / mirror / Atom feed
* audit.rules being really processed sequentially?
@ 2021-09-02 15:54 Ede Wolf
  2021-09-02 16:21 ` Steve Grubb
  0 siblings, 1 reply; 3+ messages in thread
From: Ede Wolf @ 2021-09-02 15:54 UTC (permalink / raw)
  To: linux-audit


In my pursuit of taming auditd in that it only logs what has explicitly 
been defined and nothing more, I've thought of a set of catch all rules 
at the end. As the rules file is supposedly being processed 
sequentially, i.e. first hit matches, this ought to work. But it doesn't.

Having a very simple rules file as an example:

-e 1

-a exit,always -F arch=b64 -S execve -F path=/bin/vi -k EDIT_FILE

-a always,exclude -F msgtype=EXECVE
-a always,exclude -F msgtype=FD_PAIR
-a always,exclude -F msgtype=FS_RELABEL

(continue this for every messagetype from this link:

As easily to be guessed, my expectation would be, the invokation of vi 
by anyone would get logged, as that rules comes first, but really 
nothing else, as it is being discaded by the catchall rules.

Surprisingly however, in reality, nothing gets logged at all, not even 
the invocation of vi.

Now, removing those catchall rules at the end does log the calling of 
vi, but of course also all other stuff I neither  have defined nor want 
to be written out.

So, if the audit.rules file really is being processed sequentally, what 
am I missing in my approach?

Thanks very much for any insight.


Linux-audit mailing list

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2021-09-05  8:04 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-02 15:54 audit.rules being really processed sequentially? Ede Wolf
2021-09-02 16:21 ` Steve Grubb
2021-09-05  8:04   ` Ede Wolf

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).