[PR #30] [MERGED] Split audit.rules into multiple files #111

New issue

Closed

opened 2026-03-03 14:29:43 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 14:29:43 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/konstruktoid/hardening/pull/30
Author: @frederikbosch
Created: 8/22/2018
Status: ✅ Merged
Merged: 8/30/2018
Merged by: @konstruktoid

Base: master ← Head: auditd-split

📝 Commits (4)

736bfbe split audit.rules into multiple files
5f7d02b Remove capture of all critical elements, this seems not necessary.
1bc9c8a remove watch rules for tmp now tmpfs are mounted with noexec
55c8f94 add a backlog limit as boot parameter to prevent lost messages during boot

📊 Changes

7 files changed (+82 additions, -100 deletions)

View changed files

➕ misc/audit-aggressive.rules (+34 -0)
📝 misc/audit-base.rules (+0 -97)
➕ misc/audit-docker.rules (+22 -0)
➕ misc/audit.footer (+2 -0)
➕ misc/audit.header (+15 -0)
📝 scripts/22_auditd (+8 -2)
📝 ubuntu.cfg (+1 -1)

📄 Description

I have done four things.

audit.rules split into three files
added a header and footer audit file
changed the configuration to allow a space separated list of audit rules
concatenate header, configuration rules and footer to a single audit.rules file

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/konstruktoid/hardening/pull/30 **Author:** [@frederikbosch](https://github.com/frederikbosch) **Created:** 8/22/2018 **Status:** ✅ Merged **Merged:** 8/30/2018 **Merged by:** [@konstruktoid](https://github.com/konstruktoid) **Base:** `master` ← **Head:** `auditd-split` --- ### 📝 Commits (4) - [`736bfbe`](https://github.com/konstruktoid/hardening/commit/736bfbe745fd594aed32265f3a93c712fe3c7051) split audit.rules into multiple files - [`5f7d02b`](https://github.com/konstruktoid/hardening/commit/5f7d02b3a19e6a0a25697757d676f657bc2f55eb) Remove capture of all critical elements, this seems not necessary. - [`1bc9c8a`](https://github.com/konstruktoid/hardening/commit/1bc9c8ab289d0e3c1bef6388d8183f8b6144380b) remove watch rules for tmp now tmpfs are mounted with noexec - [`55c8f94`](https://github.com/konstruktoid/hardening/commit/55c8f94a8414bd4a5339c664404e56d971cf0d19) add a backlog limit as boot parameter to prevent lost messages during boot ### 📊 Changes **7 files changed** (+82 additions, -100 deletions) <details> <summary>View changed files</summary> ➕ `misc/audit-aggressive.rules` (+34 -0) 📝 `misc/audit-base.rules` (+0 -97) ➕ `misc/audit-docker.rules` (+22 -0) ➕ `misc/audit.footer` (+2 -0) ➕ `misc/audit.header` (+15 -0) 📝 `scripts/22_auditd` (+8 -2) 📝 `ubuntu.cfg` (+1 -1) </details> ### 📄 Description I have done four things. 1. audit.rules split into three files 2. added a header and footer audit file 3. changed the configuration to allow a space separated list of audit rules 4. concatenate header, configuration rules and footer to a single audit.rules file --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>