ꦫꦣꦺꦤ꧀ꦄꦤ꧀ꦠꦱꦺꦤ

PATH: usr / sbin

#!/bin/sh

# Script to concatenate rules files found in a base audit rules directory
# to form a single /etc/audit/audit.rules file suitable for loading into
# the Linux audit system

# When forming the interim rules file, both empty lines and comment
# lines (starting with # or <whitespace>#) are stripped as the source files
# are processed.
#
# Having formed the interim rules file, the script checks if the file is empty
# or is identical to the existing /etc/audit/audit.rules and if either of
# these cases are true, it does not replace the existing file
#

# Variables
#
# DestinationFile:
#   Destination rules file
# SourceRulesDir:
#   Directory location to find component rule files
# TmpRules:
#   Temporary interim rules file
# ASuffix:
#   Suffix for previous audit.rules file if this script replaces it.
#   The file is left in the destination directory with suffix with $ASuffix

DestinationFile=/etc/audit/audit.rules
SourceRulesDir=/etc/audit/rules.d
TmpRules=`mktemp /tmp/aurules.XXXXXXXX`
ASuffix="prev"
OnlyCheck=0
LoadRules=0
RETVAL=0
usage="Usage: $0 [--check|--load]"

# Delete the interim file on faults
trap 'rm -f ${TmpRules}; exit 1' 1 2 3 13 15

try_load() {
	if [ $LoadRules -eq 1 ] ; then
		/sbin/auditctl -R ${DestinationFile}
		RETVAL=$?
	fi
}

while [ $# -ge 1 ]
do
	if [ "$1" = "--check" ] ; then
		OnlyCheck=1
	elif [ "$1" = "--load" ] ; then
		LoadRules=1
	else
		echo "$usage"
		exit 1
	fi
	shift
done

# Check environment
if [ ! -d ${SourceRulesDir} ]; then
	echo "$0: No rules directory - ${SourceRulesDir}"
	rm -f ${TmpRules}
	try_load
	exit 1
fi

# Create the interim rules file ensuring its access modes protect it
# from normal users and strip empty lines and comment lines. We also ensure
#   - the last processed -D directive without an option is emitted as the first
#     line. -D directives with options are left in place
#   - the last processed -b directory is emitted as the second line
#   - the last processed -f directory is emitted as the third line
#   - the last processed -e directive is emitted as the last line
umask 0137
echo "## This file is automatically generated from $SourceRulesDir" >> ${TmpRules}
for rules in $(/bin/ls -1v ${SourceRulesDir} | grep "\.rules$") ; do
	cat ${SourceRulesDir}/${rules}
done | awk '
BEGIN   {
        minus_e = "";
        minus_D = "";
        minus_f = "";
        minus_b = "";
        rest = 0;
} {
        if (length($0) < 1) { next; }
        if (match($0, "^\\s*#")) { next; }
        if (match($0, "^\\s*-e")) { minus_e = $0; next; }
        if (match($0, "^\\s*-D\\s*$")) { minus_D = $0; next; }
        if (match($0, "^\\s*-f")) { minus_f = $0; next; }
        if (match($0, "^\\s*-b")) { minus_b = $0; next; }
        rules[rest++] = $0;
}
END     {
        printf "%s\n%s\n%s\n", minus_D, minus_b, minus_f;
        for (i = 0; i < rest; i++) { printf "%s\n", rules[i]; }
        printf "%s\n", minus_e;
}' >> ${TmpRules}

# If empty then quit
if [ ! -s ${TmpRules} ]; then
	echo "$0: No rules"
	rm -f ${TmpRules}
	try_load
	exit $RETVAL
fi

# If the same then quit
cmp -s ${TmpRules} ${DestinationFile} > /dev/null 2>&1
if [ $? -eq 0 ]; then
	echo "$0: No change"
	rm -f ${TmpRules}
	try_load
	exit $RETVAL
elif [ $OnlyCheck -eq 1 ] ; then
	echo "$0: Rules have changed and should be updated"
	rm -f ${TmpRules}
	exit 0
fi

# Otherwise we install the new file
if [ -f ${DestinationFile} ]; then
	cp ${DestinationFile} ${DestinationFile}.${ASuffix}
fi
# We copy the file so that it gets the right selinux lable
cp ${TmpRules} ${DestinationFile}
chmod 0640 ${DestinationFile}
# Restore context on MLS system. /tmp is SystemLow & audit.rules is SystemHigh
if [ -x /sbin/restorecon ] ; then
	/sbin/restorecon -F ${DestinationFile}
fi
rm -f ${TmpRules}

try_load
exit $RETVAL

[+] ..
[-] lvchange [edit]
[-] lvmdiskscan [edit]
[-] pam_extrausers_update [edit]
[-] vgs [edit]
[-] pvdisplay [edit]
[-] e2undo [edit]
[-] pam_tally [edit]
[-] update-initramfs [edit]
[-] uuidd [edit]
[-] userdel [edit]
[-] remove-shell [edit]
[-] setcap [edit]
[-] apache2ctl [edit]
[-] cryptdisks_start [edit]
[-] cgdisk [edit]
[-] xfs_mdrestore [edit]
[-] cryptsetup [edit]
[-] dbconfig-generate-include [edit]
[-] grub-mkdevicemap [edit]
[-] tcpdump [edit]
[-] lvremove [edit]
[-] unix_chkpwd [edit]
[-] lvmsar [edit]
[-] nologin [edit]
[-] kpartx [edit]
[-] augenrules [edit]
[-] slattach [edit]
[-] phpdismod [edit]
[-] blkzone [edit]
[-] genl [edit]
[-] ebtables-nft-restore [edit]
[-] ntfslabel [edit]
[-] xtables-nft-multi [edit]
[-] xfs_io [edit]
[-] cryptsetup-reencrypt [edit]
[-] runuser [edit]
[-] modprobe [edit]
[-] thin_delta [edit]
[-] update-grub [edit]
[-] aa-remove-unknown [edit]
[-] a2ensite [edit]
[-] partprobe [edit]
[-] grpconv [edit]
[-] iscsi_discovery [edit]
[-] vcstime [edit]
[-] devlink [edit]
[-] insmod [edit]
[-] lvreduce [edit]
[-] zic [edit]
[-] xfs_fsr [edit]
[-] veritysetup [edit]
[-] ownership [edit]
[-] lvconvert [edit]
[-] shadowconfig [edit]
[-] grpunconv [edit]
[-] pwck [edit]
[-] raw [edit]
[-] accessdb [edit]
[-] blkdeactivate [edit]
[-] ldconfig.real [edit]
[-] pwconv [edit]
[-] mdadm [edit]
[-] era_check [edit]
[-] thin_repair [edit]
[-] update-rc.d [edit]
[-] ldconfig [edit]
[-] arptables-nft [edit]
[-] apparmor_parser [edit]
[-] mkntfs [edit]
[-] xfs_mkfile [edit]
[-] dhclient-script [edit]
[-] xfs_repair [edit]
[-] irqbalance [edit]
[-] runlevel [edit]
[-] halt [edit]
[-] lvrename [edit]
[-] swapoff [edit]
[-] vgscan [edit]
[-] thin_metadata_size [edit]
[-] update-grub-gfxpayload [edit]
[-] xfs_rtcp [edit]
[-] fsck [edit]
[-] sysctl [edit]
[-] mkswap [edit]
[-] autrace [edit]
[-] mkhomedir_helper [edit]
[-] pdata_tools [edit]
[-] grub-set-default [edit]
[-] mkfs.ext4 [edit]
[-] vgextend [edit]
[-] iptables-nft [edit]
[-] bcache-super-show [edit]
[-] aa-teardown [edit]
[-] pam_extrausers_chkpwd [edit]
[-] xfs_growfs [edit]
[-] shutdown [edit]
[-] rarp [edit]
[-] readprofile [edit]
[-] cron [edit]
[-] dbconfig-load-include [edit]
[-] xfs_metadump [edit]
[-] ausearch [edit]
[-] xfs_copy [edit]
[-] grub-bios-setup [edit]
[-] ebtables-restore [edit]
[-] lvextend [edit]
[-] e2fsck [edit]
[-] vgcreate [edit]
[-] installkernel [edit]
[-] rtacct [edit]
[-] agetty [edit]
[-] apache2 [edit]
[-] lvm [edit]
[-] nameif [edit]
[-] pvremove [edit]
[-] grub-mkconfig [edit]
[-] locale-gen [edit]
[-] groupmod [edit]
[-] acpid [edit]
[-] make-ssl-cert [edit]
[-] phpenmod [edit]
[-] fstrim [edit]
[-] mklost+found [edit]
[-] update-info-dir [edit]
[-] vgexport [edit]
[-] iscsi-iname [edit]
[-] ipmaddr [edit]
[-] ip [edit]
[-] mount.fuse [edit]
[-] a2query [edit]
[-] mount.vmhgfs [edit]
[-] cache_dump [edit]
[-] blockdev [edit]
[-] luksformat [edit]
[-] rmt [edit]
[-] cryptdisks_stop [edit]
[-] ip6tables-save [edit]
[-] vgconvert [edit]
[-] cfdisk [edit]
[-] update-passwd [edit]
[-] split-logfile [edit]
[-] start-stop-daemon [edit]
[-] grub-reboot [edit]
[-] validlocale [edit]
[-] httxt2dbm [edit]
[-] zerofree [edit]
[-] update-locale [edit]
[-] make-bcache [edit]
[-] ip6tables [edit]
[-] on_ac_power [edit]
[-] iptables-nft-restore [edit]
[-] modinfo [edit]
[-] chcpu [edit]
[-] cache_metadata_size [edit]
[-] ip6tables-nft [edit]
[-] dosfsck [edit]
[-] pam_getenv [edit]
[-] ip6tables-nft-restore [edit]
[-] thin_rmap [edit]
[-] pam_tally2 [edit]
[-] groupadd [edit]
[-] dmeventd [edit]
[-] biosdecode [edit]
[-] lsmod [edit]
[-] pvscan [edit]
[-] setvtrgb [edit]
[-] e2scrub_all [edit]
[-] mkfs.ntfs [edit]
[-] wipefs [edit]
[-] mkfs.vfat [edit]
[-] mkinitramfs [edit]
[-] mkdosfs [edit]
[-] irqbalance-ui [edit]
[-] fsck.vfat [edit]
[-] pam_timestamp_check [edit]
[-] arptables-save [edit]
[-] update-ca-certificates [edit]
[-] auditd [edit]
[-] mkfs.bfs [edit]
[-] ip6tables-legacy-restore [edit]
[-] cache_repair [edit]
[-] aureport [edit]
[-] update-pciids [edit]
[-] mysqld [edit]
[-] vgdisplay [edit]
[-] ufw [edit]
[-] setvesablank [edit]
[-] useradd [edit]
[-] fdisk [edit]
[-] fdformat [edit]
[-] ntfsresize [edit]
[-] iptables-legacy-restore [edit]
[-] vgreduce [edit]
[-] iscsid [edit]
[-] mkfs.xfs [edit]
[-] init [edit]
[-] vgcfgrestore [edit]
[-] multipath [edit]
[-] fatlabel [edit]
[-] mkfs.ext2 [edit]
[-] iptables-apply [edit]
[-] apparmor_status [edit]
[-] add-shell [edit]
[-] isosize [edit]
[-] groupmems [edit]
[-] ntfsclone [edit]
[-] multipathd [edit]
[-] fsck.xfs [edit]
[-] ethtool [edit]
[-] telinit [edit]
[-] rsyslogd [edit]
[-] adduser [edit]
[-] e4crypt [edit]
[-] fsck.fat [edit]
[-] grub-probe [edit]
[-] cppw [edit]
[-] xfs_admin [edit]
[-] swapon [edit]
[-] pvck [edit]
[-] ip6tables-translate [edit]
[-] iptables-restore [edit]
[-] ip6tables-restore-translate [edit]
[-] plymouthd [edit]
[-] service [edit]
[-] iptunnel [edit]
[-] e2image [edit]
[-] iptables-save [edit]
[-] e2freefrag [edit]
[-] groupdel [edit]
[-] mke2fs [edit]
[-] vpddecode [edit]
[-] vgck [edit]
[-] vigr [edit]
[-] fsck.ext3 [edit]
[-] swaplabel [edit]
[-] php-fpm7.4 [edit]
[-] arptables-restore [edit]
[-] mkfs.msdos [edit]
[-] newusers [edit]
[-] dmsetup [edit]
[-] ebtables-nft [edit]
[-] e4defrag [edit]
[-] iptables-legacy-save [edit]
[-] iptables-nft-save [edit]
[-] depmod [edit]
[-] tipc [edit]
[-] mkfs.btrfs [edit]
[-] update-mime [edit]
[-] fsck.msdos [edit]
[-] netplan [edit]
[-] getty [edit]
[-] grub-install [edit]
[-] xfs_db [edit]
[-] kbdrate [edit]
[-] mount.ntfs [edit]
[-] deluser [edit]
[-] phpquery [edit]
[-] a2enconf [edit]
[-] pvcreate [edit]
[-] iucode-tool [edit]
[-] hdparm [edit]
[-] debugfs [edit]
[-] xfs_estimate [edit]
[-] mkfs.cramfs [edit]
[-] a2dismod [edit]
[-] ip6tables-legacy-save [edit]
[-] thin_ls [edit]
[-] applygnupgdefaults [edit]
[-] iptables-legacy [edit]
[-] ebtables [edit]
[-] cache_writeback [edit]
[-] mkfs.ext3 [edit]
[-] mount.lowntfs-3g [edit]
[-] faillock [edit]
[-] vgmerge [edit]
[-] tzconfig [edit]
[-] overlayroot-chroot [edit]
[-] update-grub2 [edit]
[-] arpd [edit]
[-] killall5 [edit]
[-] xfs_spaceman [edit]
[-] iptables-restore-translate [edit]
[-] switch_root [edit]
[-] upgrade-from-grub-legacy [edit]
[-] vgmknodes [edit]
[-] addgroup [edit]
[-] losetup [edit]
[-] thin_dump [edit]
[-] a2dissite [edit]
[-] fixparts [edit]
[-] arptables-nft-save [edit]
[-] xfs_info [edit]
[-] xtables-legacy-multi [edit]
[-] fsadm [edit]
[-] visudo [edit]
[-] ldattach [edit]
[-] lvmdump [edit]
[-] xfs_ncheck [edit]
[-] lvmconfig [edit]
[-] ntfscp [edit]
[-] aa-status [edit]
[-] findfs [edit]
[-] badblocks [edit]
[-] thin_check [edit]
[-] popularity-contest [edit]
[-] vgimportclone [edit]
[-] plipconfig [edit]
[-] blkid [edit]
[-] arptables-nft-restore [edit]
[-] thin_restore [edit]
[-] mpathpersist [edit]
[-] getpcaps [edit]
[-] resize2fs [edit]
[-] popcon-largest-unused [edit]
[-] dhclient [edit]
[-] arp [edit]
[-] lvdisplay [edit]
[-] fsfreeze [edit]
[-] capsh [edit]
[-] iptables-translate [edit]
[-] thin_trim [edit]
[-] dpkg-reconfigure [edit]
[-] dosfslabel [edit]
[-] blkdiscard [edit]
[-] chroot [edit]
[-] rmmod [edit]
[-] dmidecode [edit]
[-] route [edit]
[-] pvmove [edit]
[-] pivot_root [edit]
[-] e2scrub [edit]
[-] ntfsundelete [edit]
[-] sgdisk [edit]
[-] vgimport [edit]
[-] tarcat [edit]
[-] hwclock [edit]
[-] ip6tables-nft-save [edit]
[-] lvresize [edit]
[-] xfs_freeze [edit]
[-] xfs_logprint [edit]
[-] tc [edit]
[-] filefrag [edit]
[-] lvs [edit]
[-] ebtables-save [edit]
[-] fsck.btrfs [edit]
[-] a2disconf [edit]
[-] nfnl_osf [edit]
[-] ifconfig [edit]
[-] cache_check [edit]
[-] sshd [edit]
[-] arptables [edit]
[-] fsck.ext4 [edit]
[-] iscsiadm [edit]
[-] delgroup [edit]
[-] xtables-monitor [edit]
[-] era_invalidate [edit]
[-] dmstats [edit]
[-] rtmon [edit]
[-] addgnupghome [edit]
[-] iucode_tool [edit]
[-] e2mmpstatus [edit]
[-] logsave [edit]
[-] xfs_scrub [edit]
[-] chmem [edit]
[-] chgpasswd [edit]
[-] pvchange [edit]
[-] mount.ntfs-3g [edit]
[-] reboot [edit]
[-] pam-auth-update [edit]
[-] poweroff [edit]
[-] lvcreate [edit]
[-] usermod [edit]
[-] dpkg-preconfigure [edit]
[-] invoke-rc.d [edit]
[-] audispd [edit]
[-] auditctl [edit]
[-] vgcfgbackup [edit]
[-] vgsplit [edit]
[-] era_restore [edit]
[-] vgrename [edit]
[-] gdisk [edit]
[-] fsck.ext2 [edit]
[-] sulogin [edit]
[-] pwunconv [edit]
[-] lvscan [edit]
[-] dumpe2fs [edit]
[-] fsck.cramfs [edit]
[-] mkfs.minix [edit]
[-] atd [edit]
[-] iptables [edit]
[-] mii-tool [edit]
[-] rmt-tar [edit]
[-] logrotate [edit]
[-] chpasswd [edit]
[-] zramctl [edit]
[-] ebtables-nft-save [edit]
[-] cache_restore [edit]
[-] pvs [edit]
[-] unix_update [edit]
[-] fstab-decode [edit]
[-] grub-macbless [edit]
[-] getcap [edit]
[-] ip6tables-restore [edit]
[-] iscsistart [edit]
[-] xfs_quota [edit]
[-] rtcwake [edit]
[-] pvresize [edit]
[-] bridge [edit]
[-] ip6tables-legacy [edit]
[-] mkfs [edit]
[-] lvmpolld [edit]
[-] xfs_scrub_all [edit]
[-] ctrlaltdel [edit]
[-] cpgr [edit]
[-] e2label [edit]
[-] sfdisk [edit]
[-] lvmsadc [edit]
[-] vipw [edit]
[-] tune2fs [edit]
[-] vgchange [edit]
[-] apachectl [edit]
[-] era_dump [edit]
[-] vgremove [edit]
[-] xfs_bmap [edit]
[-] iconvconfig [edit]
[-] a2enmod [edit]
[-] mkfs.fat [edit]
[-] mdmon [edit]
[-] ip6tables-apply [edit]
[-] check_forensic [edit]
[-] grpck [edit]
[-] fsck.minix [edit]
[-] integritysetup [edit]
[-] parted [edit]