Audit rules keys

[Linda Knippers]

Henning, Arthur C. (CSL) wrote:
> Using system-config-audit getting key (-k) configuration errors when
> saving changes.
> 
> [root at localhost ~]# Stopping auditd: [  OK  ]
> Starting auditd: [  OK  ]
> key option needs a watch or syscall given prior to it

This is telling you that the -k flag needs to be after a -S
flag.  I don't know why the order matters but apparently it does.

> There was an error in line 9 of /etc/audit/audit.rules
> cat /etc/audit/audit.rules
> -e 1
> -f 2
> -b 8192
> -r 0
> 
> -D
> -a entry,always -S adjtimex -S settimeofday
> -a entry,always -S clock_settime
> -a entry,always -k kill -S kill
try:
-a entry, always -S kill -k kill

And for the rest, make the -k stuff to the end.

> -a exit,always -k system-locale -S sethostname
> -a exit,always -F exit=-13 -k creation -S creat -S mkdir -S mknod -S
> link -S symlink
> -a exit,always -F exit=-13 -k creation -S mkdirat -S mknodat -S linkat
> -S symlinkat
> 
> If I remove the key from line 9 and save, get error reported line 10,
> etc.
> 
> Started with NISPOM.rules contrib file.

Are the options in the wrong order in the contrib file too?
The draft I saw posted for comments was in the correct order
but I haven't looked at what's currently shipped.

-- ljk
> 
> Art Henning (CSL) 
> Enterprise IT Solutions
> Northrop Grumman Corp
> art.henning at ngc.com
> 
> 
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit