FM / sample-rules

/usr/share/audit/sample-rules

Name	Size	Mode	Actions
10-base-config.rules	244	0644	edit dl rm
10-no-audit.rules	284	0644	edit dl rm
11-loginuid.rules	93	0644	edit dl rm
12-cont-fail.rules	333	0644	edit dl rm
12-ignore-error.rules	327	0644	edit dl rm
20-dont-audit.rules	516	0644	edit dl rm
21-no32bit.rules	273	0644	edit dl rm
22-ignore-chrony.rules	254	0644	edit dl rm
23-ignore-filesystems.rules	507	0644	edit dl rm
30-nispom.rules	4943	0644	edit dl rm
30-ospp-v42-1-create-failed.rules	1500	0644	edit dl rm
30-ospp-v42-1-create-success.rules	746	0644	edit dl rm
30-ospp-v42-2-modify-failed.rules	1646	0644	edit dl rm
30-ospp-v42-2-modify-success.rules	826	0644	edit dl rm
30-ospp-v42-3-access-failed.rules	625	0644	edit dl rm
30-ospp-v42-3-access-success.rules	399	0644	edit dl rm
30-ospp-v42-4-delete-failed.rules	562	0644	edit dl rm
30-ospp-v42-4-delete-success.rules	284	0644	edit dl rm
30-ospp-v42-5-perm-change-failed.rules	816	0644	edit dl rm
30-ospp-v42-5-perm-change-success.rules	414	0644	edit dl rm
30-ospp-v42-6-owner-change-failed.rules	579	0644	edit dl rm
30-ospp-v42-6-owner-change-success.rules	295	0644	edit dl rm
30-ospp-v42.rules	5948	0644	edit dl rm
30-pci-dss-v31.rules	6497	0644	edit dl rm
30-stig.rules	6942	0644	edit dl rm
31-privileged.rules	1458	0644	edit dl rm
32-power-abuse.rules	213	0644	edit dl rm
40-local.rules	156	0644	edit dl rm
41-containers.rules	439	0644	edit dl rm
42-injection.rules	672	0644	edit dl rm
43-module-load.rules	398	0644	edit dl rm
44-installers.rules	584	0644	edit dl rm
70-einval.rules	326	0644	edit dl rm
71-networking.rules	151	0644	edit dl rm
99-finalize.rules	86	0644	edit dl rm
README-rules	1421	0644	edit dl rm

Edit: /usr/share/audit/sample-rules/README-rules (1421B)

This group of rules are meant to be used with the augenrules program.
The augenrules program expects rules to be located in /etc/audit/rules.d/
The rules will get processed in a specific order based on their natural
sort order. To make things easier to use, the files in this directory are
organized into groups with the following meanings:

10 - Kernel and auditctl configuration
20 - Rules that could match general rules but we want a different match
30 - Main rules
40 - Optional rules
50 - Server Specific rules
70 - System local rules
90 - Finalize (immutable)

There is one set of rules, 31-privileged.rules, that should be regenerated.
There is a script in the comments of that file. You can uncomment the commands
and run the script and then rename the resulting file.

The rules are not meant to be used all at once. They are pieces of a policy
that should be thought out and individual files copied to /etc/audit/rules.d/
For example, if you wanted to set a system up in the STIG configuration, copy
rules 10-base-config, 30-stig, 31-privileged, and 99-finalize. You can add
more if you like. Also, not all arches have the same syscalls. It is expected
that the rules be fine tuned for the arch they are deployed on. For example,
aarch64 does not have the open syscall. It should just be deleted from the
rules.

Once you have the rules in the rules.d directory, you can load them by running
augenrules --load

cmd: