aaron/ansible-role-auditd
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

add config option for global filters

Browse Source
This commit is contained in:
Tim Herren
2021-09-20 17:12:30 +02:00
parent 2740f421be
commit 0e2762ca6e
2 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
README.md
View File

@@ -150,6 +150,12 @@ auditd_custom_rules:
- arch=b64 - arch=b64
executable: /bin/id executable: /bin/id
comment: execution_bin_id comment: execution_bin_id
# define general filter rule
- type: global_filter
action: always,exit
filters:
- dir=/opt/application
- perm=wa
``` ```
All the configurations for the audit daemon are configurable as variables. See `defaults/main.yaml` for more details. All the configurations for the audit daemon are configurable as variables. See `defaults/main.yaml` for more details.

3
templates/custom.rules.j2
View File

@@ -21,5 +21,8 @@
{% if rule.type == 'executable' %} {% if rule.type == 'executable' %}
-a {{ rule.action }} -F exe={{ rule.executable }}{% if rule.filters is defined %}{% for filter in rule.filters %} -F {{ filter }}{% endfor %}{% endif %} -S execve -k {{ rule.comment }} -a {{ rule.action }} -F exe={{ rule.executable }}{% if rule.filters is defined %}{% for filter in rule.filters %} -F {{ filter }}{% endfor %}{% endif %} -S execve -k {{ rule.comment }}
{% endif %} {% endif %}
{% if rule.type == 'global_filter' %}
-a {{ rule.action }}{% if rule.filters is defined %}{% for filter in rule.filters %} -F {{ filter }}{% endfor %}{% endif %}
{% endif %}
{% endfor %} {% endfor %}
{% endif %} {% endif %}