Setting priority to auditd rule files

[Steve Grubb]

Hello,

On Monday, January 30, 2023 12:21:53 AM EST Anurag Aggarwal wrote:
> As per my understanding, currently auditd picks up rule files as per
> alphabetical order.

Auditd picks up the rules in /etc/audit/audit.rules  That in turn is compiled 
by augenrules which uses the order as given from "ls -v".

> Is there a way to force auditd to prioritize which rule file should be
> first read and applied, other than renaming it as 000-<app>.rules and
> hoping that customers don't have anything lexicographically smaller than
> this?

You can use "ls -v" to figure out how to make a rule that is ahead of 10-base-
config.rules. even 10-a.rule should go first. Or you can rename 10-base-
config.rules to be a higher number.

-Steve