AUDITCTL(8) AUDITCTL(8) auditctl - auditctl [] auditctl . -b _ () ( =64). . --___ _ ( 60*HZ) auditd. 10 . --______ . -c . . . -D . (-k) . -e [0..2] . 0 . 1 . 2 . audit.rules . . . -f [0..2] 0= 1=printk 2=. . : . 1. 2. -h, --help -i . auditctl . -s . --loginuid-immutable (loginuids) . CAP_AUDIT_CONTROL. . (loginuid) . -q mount-point,subtree . . . . -r rate / (0=). . 0. --reset-lost . -R file auditctl . . . . '#' . auditctl . auditctl (shell) bash . . --signal signal . . TERM, HUP, USR1, USR2, CONT stop, reload, rotate, resume, state. -t . -l 1 . . (-k) (-i) a0 a3 . -m text . CAP_AUDIT_WRITE ( ). USER. -s . -e -f -r -b. pid . pid 0 . "lost" . "backlog" auditd. -i . -v auditctl. -a [list,action|action,list] list action. . . . list,action action,list. list : . -- fork() clone(). uid gid . exit . . user . . : uid auid gid pid subj_user subj_role subj_type subj_sen subj_clr msgtype . . CAP_AUDIT_WRITE . "never" () . exclude . . avc . . "never" (). . fstype. tracefs debugfs. io_uring io_uring. -S . . : never . . . . always . -A list,action list action. -C [f=f | f!=f] : . . -C. -F . : . : auid, uid, euid, suid, fsuid, obj_uid; and gid, egid, sgid, fsgid, obj_gid uid gid. . obj_uid/gid . -d list,action list action. () . -F [n=v | n!=v | nv | n<=v | n>=v | n&v | n&=v] : . 64 . -F. (AND) ( -C) . 8 - . (AND) (AND) . . . : a0, a1, a2, a3 4 . . . . . (IPC). arch (CPU) . 'uname -m'. 32 32 b32 . 64 b64. . x86_64 ppc. -S auditctl . auid . audit uid. loginuid. . devmajor devminor dir . . . "-w". egid . . euid . . exe . = !=. . exit . (errno) . fsgid . . fstype . . debugfs tracefs. fsuid . . filetype . FIFO. gid . . inode Inode key . 31 . . . ausearch . (-D) (-l) . auditd . _ . . __ (UID) __ (GID) _ SE Linux _ SE Linux _ SE Linux __ SE Linux __ SE Linux . . . . (inode) . . . . r= w= x= a= . (syscall) . . (open flags) . (perm) . . (arch) (perm). . (arch) . . pid ppid saddr_fam /usr/include/bits/socket.h. IPv4 2 IPv6 10. sessionid subj_user SE Linux subj_role SE Linux subj_type SE Linux subj_sen SE Linux subj_clr SE Linux sgid . getresgid(2). success >= 0 / /. 1 / 0 /. suid . getresuid(2). uid . . -k key . . . . -p [r|w|x|a] . . . -S [Syscall name or number|all] . 'all'. . . -S . . . x86_64 auditctl ( b64) . 32 64 . 32 64 . b32 b64 . . -w path . -F path . -F dir . -w . . -p -k. -W path . . -d . . 10 . . . : auditctl -a always,exit -F arch=b64 -S openat -F success=0 auditctl -a always,exit -F arch=b64 -S truncate -F success=0 : auditctl -a always,exit -F arch=b64 -S openat -S truncate -F success=0 . . /etc /usr /sbin : auditctl -a always,exit -F arch=b64 -S openat,truncate -F dir=/etc -F success=0 . . : # : auditctl -a always,exit -S all -F pid=1005 # auditctl -a always,exit -S all -F exe=/usr/bin/ls : auditctl -a always,exit -S openat -F auid=510 openat : auditctl -a always,exit -S openat -F success=0 ( ): auditctl -w /etc/shadow -p wa # Note this slows the system auditctl -a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa ( ): auditctl -w /etc/ -p wa # Note this slows the system auditctl -a always,exit -F arch=b64 -F dir=/etc/ -F perm=wa : auditctl -a always,exit -F dir=/home/ -F uid=0 -C auid!=obj_uid : # Remove all existing rules -D # Never record sudo invocations -A exclude,always -F exe=/usr/bin/sudo auditd -a never,task . . . auditd 10-no-audit.rules 10-base-config.rules . auditctl -l never,task . /etc/audit/audit.rules /etc/audit/audit-stop.rules audit.rules(7) ausearch(8) aureport(8) auditd(8). Steve Grubb 3 . . : . 2023 AUDITCTL(8)