Question

我无法使用/etc/audit/audit.rules向审计守护程序添加规则每次我使用auditctl添加规则时，它都会在重新启动或重新启动审计守护程序时被删除，我已经附加了/etc/audit/audit.rules和/etc/audit/auditd.conf cat /etc/audit/auditd.conf

$ cat /etc/audit/auditd.conf 
#
# This file controls the configuration of the audit daemon
#

local_events = yes
write_logs = yes
log_file = /NU_Application/audit.log
log_group = root
log_format = RAW
flush = INCREMENTAL_ASYNC
freq = 50
max_log_file = 8
num_logs = 5
priority_boost = 4
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = NONE
##name = mydomain
max_log_file_action = ROTATE
space_left = 75
space_left_action = SYSLOG
verify_email = yes
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND
use_libwrap = yes
##tcp_listen_port = 22
tcp_listen_queue = 5
tcp_max_per_addr = 1
##tcp_client_ports = 1024-65535
tcp_client_max_idle = 0
enable_krb5 = no
krb5_principal = auditd
##krb5_key_file = /etc/audit/audit.key
distribute_network = no

cat /etc/audit/audit.rules

$ cat /etc/audit/audit.rules 
## First rule - delete all

## Increase the buffers to survive stress events.
## Make this bigger for busy systems
-b 8192

## This determine how long to wait in burst of events
--backlog_wait_time 0

## Set failure mode to syslog
-f 1
-w /var/log/lastlog -p wa
root@iWave-G22M:~# auditctl

当我重新启动审核守护程序（即/etc/init.d/auditd restart）并尝试列出规则时，我收到消息No rules

$ /etc/init.d/auditd restart
Restarting audit daemon auditd
type=1305 audit(1558188111.980:3): audit_pid=0 old=1148 auid=4294967295 ses=4294967295
 res=1
type=1305 audit(1558188112.010:4): audit_enabled=1 old=1 auid=4294967295 ses=4294967295
 res=1
type=1305 audit(1558188112.020:5): audit_pid=30342 old=0 auid=4294967295 ses=4294967295
 res=1
1
$ auditctl -l               
No rules

操作系统信息

$ uname -a
Linux iWave-G22M 3.10.31-ltsi-svn743 #5 SMP PREEMPT Mon May 27 18:28:01 IST 2019 armv7l GNU/Linux

audit_2.8.4.bb文件用于通过yocto安装auditd守护程序 audit_2.8.4.bb的路径-http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/tree/recipes-security/audit/audit_2.8.4.bb?h=master

Answer 1

通过 /etc/audit/audit.rules 和 auditctl 命令添加的

审计规则不是永久的。要使它们在重新启动后永久存在，您必须添加它们 /etc/audit/rules.d/audit.rules 文件。添加规则后，重新启动 auditd服务并运行命令 auditctl -l </ strong>，它将列出所有规则，并反映在 /etc/audit/audit.rules中文件。

审核守护程序不采用audit.rules中的规则

1 个答案: