Managing Audit Event Records Using Keys - Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual

#-a entry,always -S semctl
#-a entry,always -S semget
#-a entry,always -S semop
#-a entry,always -S semtimedop
## shmctl
-a entry,always -S ipc -F a0=24
## shmget
-a entry,always -S ipc -F a0=23
## Use these lines on x86_64, ia64 instead
#-a entry,always -S shmctl
#-a entry,always -S shmget
Audit system calls related to IPC SYSV message queues. In this case, the a0
values specify that auditing is added for the msgctl and msgget system calls (14
and 13). 64-bit platforms, like x86_64 and ia64, do not use multiplexing on ipc
system calls. For these platforms, comment the first two rules and add the plain
system call rules without argument filtering.
Audit system calls related to IPC SYSV message semaphores. In this case, the
a0 values specify that auditing is added for the semctl, semget, semop, and sem-
timedop system calls (3, 2, 1, and 4). 64-bit platforms, like x86_64 and ia64, do
not use multiplexing on ipc system calls. For these platforms, comment the first
four rules and add the plain system call rules without argument filtering.
Audit system calls related to IPC SYSV shared memory. In this case, the a0 values
specify that auditing is added for the shmctl and shmget system calls (24, 23).
64-bit platforms, like x86_64 and ia64, do not use multiplexing on ipc system
calls. For these platforms, comment the first two rules and add the plain system
call rules without argument filtering.
32.7 Managing Audit Event Records
Using Keys
After configuring a few rules generating events and populating the logs, you need to
find a way to tell one event from the others. Using the ausearch command, you can
filter the logs for various criteria. Using ausearch -m message_type, you can
at least filter for events of a certain type. However, to be able to filter for events related
to a particular rule, you need to add a key to this rule in the /etc/audit/audit
.rules file. This key is then added to the event record every time the rule logs an
Introducing an Audit Rule Set 393