Red Hat Enterprise Linux 5 Administration Unleashed

Writing Audit Rules and Watches 513obj_lev_lowSELinux low level for the resource.obj_lev_highSELinux high level for the resource.subj_userSELinux user for the program.subj_roleSELinux role for the program.subj_typeSELinux type for the program.subj_senSELinux sensitivity for the program.subj_clrSELinux clearance for the program.25The -a option appends the rule to the list. To add the rule to the beginning of the list,replace -a with -A. Deleting a rule has the same syntax except -a is replaced by -d. Todelete all rules, specify the -D option. Listing 25.2 contains some example audit rules for/etc/audit/audit.rules.LISTING 25.2Example Audit Rules#Record all file opens from user 501#Use with caution since this can quickly#produce a large quantity of records-a exit,always -S open -F uid=501 -F key=501open#Record file permission changes-a entry,always -S chmodTIPIf the audit package is installed, additional examples are in the *.rules files/usr/share/doc/audit-/ directory.When an action from the defined rules occurs, it is sent through the dispatcher if one isdefined in /etc/audit/auditd.conf, and then a log message is written to /var/log/audit/audit.log. For example, Listing 25.3 contains the log entries for the first rule inListing 25.2, which logs file opens from user 501. The rule includes a filter key, whichappears at the end of the log entry in Listing 25.3.