Novell LINUX ENTERPRISE DESKTOP 11, Руководство пользователя

Страница: 447 / 450

#-a entry,always -S semctl
#-a entry,always -S semget
#-a entry,always -S semop
#-a entry,always -S semtimedop
❸
## shmctl
-a entry,always -S ipc -F a0=24
## shmget
-a entry,always -S ipc -F a0=23
## Use these lines on x86_64, ia64 instead
#-a entry,always -S shmctl
#-a entry,always -S shmget
❶
Audit system calls related to IPC SYSV message queues. In this case, the
a0
values specify that auditing is added for the msgctl and msgget system calls (
14
and
13
). 64-bit platforms, like x86_64 and ia64, do not use multiplexing on ipc
system calls. For these platforms, comment the first two rules and add the plain
system call rules without argument filtering.
❷ Audit system calls related to IPC SYSV message semaphores. In this case, the
a0
values specify that auditing is added for the semctl, semget, semop, and sem-
timedop system calls (
3
,
2
,
1
, and
4
). 64-bit platforms, like x86_64 and ia64, do
not use multiplexing on ipc system calls. For these platforms, comment the first
four rules and add the plain system call rules without argument filtering.
❸
Audit system calls related to IPC SYSV shared memory. In this case, the
a0
values
specify that auditing is added for the shmctl and shmget system calls (
24
,
23
).
64-bit platforms, like x86_64 and ia64, do not use multiplexing on ipc system
calls. For these platforms, comment the first two rules and add the plain system
call rules without argument filtering.
32.7 Managing Audit Event Records
Using Keys
After configuring a few rules generating events and populating the logs, you need to
find a way to tell one event from the others. Using the
ausearch
command, you can
filter the logs for various criteria. Using
ausearch -m message_type
, you can
at least filter for events of a certain type. However, to be able to filter for events related
to a particular rule, you need to add a key to this rule in the
/etc/audit/audit
.rules
file. This key is then added to the event record every time the rule logs an
Introducing an Audit Rule Set 433