Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 8

2 8 Support
28.1 Updating Novell AppArmor Online . . . . . . . . . . . . . . . . .
28.2 Using the Man Pages . . . . . . . . . . . . . . . . . . . . . . .
28.3 For More Information . . . . . . . . . . . . . . . . . . . . . .
28.4 Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . .
28.5 Reporting Bugs for AppArmor . . . . . . . . . . . . . . . . . . .
2 9 AppArmor Glossary
Part V The Linux Audit Framework
3 0 Understanding Linux Audit
30.1 Introducing the Components of Linux Audit . . . . . . . . . . . . .
30.2 Configuring the Audit Daemon . . . . . . . . . . . . . . . . . . .
30.3 Controlling the Audit System Using auditctl . . . . . . . . . . . . .
30.4 Passing Parameters to the Audit System . . . . . . . . . . . . . . .
30.5 Understanding the Audit Logs and Generating Reports . . . . . . . . .
30.6 Querying the Audit Daemon Logs with ausearch . . . . . . . . . . .
30.7 Analyzing Processes with autrace . . . . . . . . . . . . . . . . . .
30.8 Visualizing Audit Data . . . . . . . . . . . . . . . . . . . . . .
3 1 Setting Up the Linux Audit Framework
31.1 Determining the Components to Audit . . . . . . . . . . . . . . .
31.2 Configuring the Audit Daemon . . . . . . . . . . . . . . . . . . .
31.3 Enabling Audit for System Calls . . . . . . . . . . . . . . . . . .
31.4 Setting Up Audit Rules . . . . . . . . . . . . . . . . . . . . . .
31.5 Configuring Audit Reports . . . . . . . . . . . . . . . . . . . . .
31.6 Configuring Log Visualization . . . . . . . . . . . . . . . . . . .
3 2 Introducing an Audit Rule Set
32.1 Adding Basic Audit Configuration Parameters . . . . . . . . . . . .
32.2 Adding Watches on Audit Log Files and Configuration Files . . . . . . .
32.3 Monitoring File System Objects . . . . . . . . . . . . . . . . . .
32.4 Monitoring Security Configuration Files and Databases . . . . . . . . .
32.5 Monitoring Miscellaneous System Calls . . . . . . . . . . . . . . .
32.6 Filtering System Call Arguments . . . . . . . . . . . . . . . . . .
32.7 Managing Audit Event Records Using Keys . . . . . . . . . . . . . .
3 3 Useful Resources
317
317
317
319
320
327
329
333
335
338
339
345
347
351
363
367
368
371
372
373
374
375
377
380
383
384
385
386
387
390
390
393
395