Novell LINUX ENTERPRISE DESKTOP 11, Manual, Page: 429 / 450

As you need system call auditing capabilities even when you are configuring plain file
or directory watches, you need to enable audit contexts for system calls. To enable audit
contexts for the duration of the current session only, execute
auditctl -e 1
as
root
. To disable this feature, execute
auditctl -e 0
as
root
.
To enable audit contexts for system calls permanently, open the
/etc/sysconfig/
auditd
configuration file as
root
and set
AUDITD_DISABLE_CONTEXTS
to
no
.
Then restart the audit daemon with the
rcauditd restart
command. To turn this
feature off temporarily, use
auditctl -e 0
. To turn it off permanently, set
AUDITD_DISABLE_CONTEXTS
to
yes
.
31.4 Setting Up Audit Rules
Using audit rules, determine which aspects of the system should be analyzed by audit.
Normally this includes important databases and security-relevant configuration files.
You may also analyze various system calls in detail if a broad analysis of your system
is required. A very detailed example configuration that includes most of the rules that
are needed in a CAPP compliant environment is available in
Chapter 32, Introducing
an Audit Rule Set (page 423).
Audit rules can be passed to the audit daemon on the
auditctl
command line as well
as by composing a rule set in
/etc/audit/audit.rules
which is processed
whenever the audit daemon is started. To customize
/etc/audit/audit.rules
either edit it directly, or use YaST: Security and Users > Linux Audit Framework (LAF)
> Rules for 'auditctl'. Rules passed on the commandline are not persistent and have to
be re-entered when the audit daemon is restarted.
A simple rule set for very basic auditing on a few important files and directories could
look like this:
# basic audit system parameters
-D
-b 8192
-f 1
-e 1
# some file and directory watches with keys
-w /var/log/audit/ -k LOG_audit
-w /etc/audit/auditd.conf -k CFG_audit_conf -p rxwa
-w /etc/audit.rules -k CFG_audit_rules -p rxwa
Setting Up the Linux Audit Framework 415