On Friday, April 19, 2013 07:23:53 AM Burn Alting wrote: > Steve, > > I will make the changes on the weekend and re-submit.
No need, I can take care of it. I just wanted to air the concerns and make sure everyone was in agreement or maybe someone saw another way to solve the problem. I will merge the code today with a couple changes. I am trying to get the audit package ready for another release sometime in the next couple days. So, if anyone has any other bugs...now's a good time to air them. :-) -Steve > On Thu, 2013-04-18 at 09:49 -0400, Steve Grubb wrote: > > On Sunday, April 07, 2013 09:16:46 PM Burn Alting wrote: > > > Please find attached my patch on this matter. > > > > Thanks for taking this on. > > > > > I essence, /etc/audit/audit.rules is now formed from files (.rules > > > suffixed) within /etc/audit/rules.d. The new script /sbin/augenrules is > > > executed by from either startup script, /etc/init.d/auditd > > > or /usr/lib/systemd/system/auditd.service before calling auditctl. > > > > One issue that I am concerned about is how this feature gets added to > > existing setups. For example, someone may have a /etc/audit/audit.rules > > file, then upgrade and if there is an empty shipped policy in > > /etc/audit/audit.d, it will erase the installed rules. > > > > So, I think we should have an /etc/sysconfig option that enables > > augenrules so that an admin has to do something to turn this on thus > > preventing automatic deletion of rules. > > > > For systemd, I think we want to ship the service file with the > > ExecStartPost line commented out which then requires an admin to take an > > action to enable. We really don't want unexpected things to happen during > > an upgrade.> > > > The generated file ensures > > > > > > - the last processed -D directive without an option, if present, is > > > > > > emitted on the first line > > > > In generating rules, we should always start with -D. I can't imagine not > > having it. > > > > > - the last processed -b directive, if present, is emitted on the second > > > > > > line > > > > We probably want the largest in all the processed files. > > > > > - the last processed -f directive, if present, is emitted on the third > > > > > > line > > > > We probably want the largest here, too. > > > > > - the last processed -e directive, if present, is emitted as the last > > > > > > line. > > > > I was thinking that if any of the files try to ask for it to be immutable, > > then it should go at the end. > > > > > The file, /etc/audit/audit.rules, is only updated if it has changed. > > > > > > > https://www.redhat.com/mailman/listinfo/linux-audit > > > > That is great, because any write could be an auditable event. At some > > point we also might want to add support for a --check option which does > > everything except overwrite the final rules. > > > > -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
