Auditd : Add Audit Rules2025/08/17 |
|
It's possible to add your own Audit rules like follows. |
|
| [1] | For example, Configure Audit rule that records writing and attributes change for [/etc/hosts]. |
|
# display current rules (no rules by default like follows) root@dlp:~# auditctl -l No rules # perm : [r|w|x|a] : specify target action for Audit # ⇒ r=read, w=write, x=execute, a=attributes # key : [words] : set keys for searching logs root@dlp:~# auditctl -a always,exit -F arch=b64 -F path=/etc/hosts -F perm=wa -F key=hosts_change root@dlp:~# auditctl -l -a always,exit -F arch=b64 -S open,bind,truncate,ftruncate,rename,mkdir,rmdir,creat,link,unlink,symlink,chmod,fchmod,chown,fchown,lchown,mknod,acct,swapon,quotactl,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr,openat,mkdirat,mknodat,fchownat,unlinkat,renameat,linkat,symlinkat,fchmodat,fallocate,renameat2,openat2 -F path=/etc/hosts -F perm=wa -F key=hosts_change |
| [2] | When some actions are set and it is detected by new Audit rules, Audit logs are recorded like follows. |
|
root@dlp:~# ausearch -k hosts_change | aureport -f -i File Report =============================================== # date time file syscall success exe auid event =============================================== 1. 08/15/2025 13:59:13 /etc/hosts~ rename yes /usr/bin/vim.basic root 179 2. 08/15/2025 13:59:13 /etc/hosts openat yes /usr/bin/vim.basic root 180 3. 08/15/2025 13:59:13 (null) fchmod yes /usr/bin/vim.basic root 181 4. 08/15/2025 13:59:13 /etc/hosts setxattr yes /usr/bin/vim.basic root 182 5. 08/15/2025 13:59:46 /etc/hosts~ rename yes /usr/bin/vim.basic root 187 6. 08/15/2025 13:59:46 /etc/hosts openat yes /usr/bin/vim.basic root 188 7. 08/15/2025 13:59:46 (null) fchmod yes /usr/bin/vim.basic root 189 8. 08/15/2025 13:59:46 /etc/hosts setxattr yes /usr/bin/vim.basic root 190 |
| [3] | Rules added by [auditctl] command are not kept after restarting System, so it needs to add them in a file under [/etc/audit/rules.d] if you'd like to keep persistently. It's OK to add rules to any file name you like under [/etc/audit/rules.d], but extension should be [.rules]. |
|
# output current rules to [additional.rules] root@dlp:~# auditctl -l >> /etc/audit/rules.d/additional.rules |
| [4] | If you set a directory for Audit Target, all files are targeted recursively under the directory. |
|
# set Audit rule (reading) to [/home/testdir/] root@dlp:~# auditctl -a always,exit -F arch=b64 -F dir=/home/testdir -F perm=r -F key=testdir_audit root@dlp:~# auditctl -l -a always,exit -F arch=b64 -S open,bind,truncate,ftruncate,rename,mkdir,rmdir,creat,link,unlink,symlink,chmod,fchmod,chown,fchown,lchown,mknod,acct,swapon,quotactl,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr,openat,mkdirat,mknodat,fchownat,unlinkat,renameat,linkat,symlinkat,fchmodat,fallocate,renameat2,openat2 -F path=/etc/hosts -F perm=wa -F key=hosts_change -a always,exit -F arch=b64 -S open,readlink,quotactl,getxattr,lgetxattr,fgetxattr,listxattr,llistxattr,flistxattr,openat,readlinkat,openat2 -F dir=/home/testdir -F perm=r -F key=testdir_audit # logs are recorded like follows root@dlp:~# ausearch -k testdir_audit | aureport -f -i File Report =============================================== # date time file syscall success exe auid event =============================================== 1. 08/15/2025 14:03:00 /home/testdir sendto yes /usr/sbin/auditctl root 175 2. 08/15/2025 14:04:05 /home/testdir/testfile.txt openat yes /usr/bin/vim.basic root 176 3. 08/15/2025 14:04:05 /home/testdir/testfile.txt readlink no /usr/bin/vim.basic root 177 4. 08/15/2025 14:04:05 /home/testdir/.testfile.txt.swp openat yes /usr/bin/vim.basic root 178 5. 08/15/2025 14:04:05 /home/testdir/.testfile.txt.swx openat yes /usr/bin/vim.basic root 179 6. 08/15/2025 14:04:05 /home/testdir/.testfile.txt.swp openat yes /usr/bin/vim.basic root 180 7. 08/15/2025 14:04:05 /home/testdir/testfile.txt openat yes /usr/bin/vim.basic root 181 8. 08/15/2025 14:04:08 /home/testdir/testfile.txt getxattr no /usr/bin/vim.basic root 182 9. 08/15/2025 14:04:08 /home/testdir/testfile.txt~ listxattr yes /usr/bin/vim.basic root 183 10. 08/15/2025 14:05:26 /home/testdir/test.txt openat yes /usr/bin/cat root 184 ..... ..... |
| [5] | For example, Set Audit rule that monitors files removed by users who has over UID 1000. |
|
root@dlp:~# auditctl -a always,exit -F arch=b64 -S unlink,unlinkat -F 'auid>=1000' -F 'auid!=-1' -F key=delete_audit root@dlp:~# auditctl -l -a always,exit -F arch=b64 -S open,bind,truncate,ftruncate,rename,mkdir,rmdir,creat,link,unlink,symlink,chmod,fchmod,chown,fchown,lchown,mknod,acct,swapon,quotactl,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr,openat,mkdirat,mknodat,fchownat,unlinkat,renameat,linkat,symlinkat,fchmodat,fallocate,renameat2,openat2 -F path=/etc/hosts -F perm=wa -F key=hosts_change -a always,exit -F arch=b64 -S open,readlink,quotactl,getxattr,lgetxattr,fgetxattr,listxattr,llistxattr,flistxattr,openat,readlinkat,openat2 -F dir=/home/testdir -F perm=r -F key=testdir_audit -a always,exit -F arch=b64 -S unlink,unlinkat -F auid>=1000 -F auid!=-1 -F key=delete_audit # logs are recorded like follows root@dlp:~# ausearch -k delete_audit | aureport -f -i File Report =============================================== # date time file syscall success exe auid event =============================================== 1. 08/15/2025 14:08:34 /var/lib/wtmpdb/wtmp.db-journal unlink yes /usr/bin/login debian 230 2. 08/15/2025 14:08:34 /run/user/1000/systemd/ unlink no /usr/lib/systemd/systemd debian 236 3. 08/15/2025 14:08:34 /run/user/1000/systemd/ unlink no /usr/lib/systemd/systemd debian 237 4. 08/15/2025 14:08:43 /tmp/test2.txt unlinkat yes /usr/bin/rm debian 244 5. 08/15/2025 14:08:44 /var/lib/wtmpdb/wtmp.db-journal unlink yes /usr/bin/login debian 246 6. 08/15/2025 14:08:51 /var/lib/wtmpdb/wtmp.db-journal unlink yes /usr/bin/login trixie 254 7. 08/15/2025 14:08:51 /run/user/1001/systemd/ unlink no /usr/lib/systemd/systemd trixie 260 8. 08/15/2025 14:08:51 /run/user/1001/systemd/ unlink no /usr/lib/systemd/systemd trixie 261 9. 08/15/2025 14:08:54 /run/user/1000/systemd/units/invocation:dbus.socket unlink yes /usr/lib/systemd/systemd debian 266 10. 08/15/2025 14:08:54 /run/user/1000/systemd/units/invocation:ssh-agent.socket unlink yes /usr/lib/systemd/systemd debian 267 11. 08/15/2025 14:08:54 init.scope unlinkat no /usr/lib/systemd/systemd debian 268 12. 08/15/2025 14:08:55 testfile2.txt unlinkat yes /usr/bin/rm trixie 271 13. 08/15/2025 14:08:59 /var/lib/wtmpdb/wtmp.db-journal unlink yes /usr/bin/su trixie 275 |
| Sponsored Link |