aboutsummaryrefslogtreecommitdiffstats
path: root/framework/src/audit/init.d/augenrules
diff options
context:
space:
mode:
authorAshlee Young <ashlee@wildernessvoice.com>2016-01-20 01:10:01 +0000
committerAshlee Young <ashlee@wildernessvoice.com>2016-01-20 01:10:11 +0000
commit19d701ddf07d855128ded0cf2b573ce468e3bdd6 (patch)
tree0edcd3461ca903c76e431bb7c6348c42a0f12488 /framework/src/audit/init.d/augenrules
parentfac6fbefbfad1cf837ddd88bc0d330559c8eb6f9 (diff)
Removing Suricata and Audit from source repo, and updated build.sh to avoid building suricata. Will re-address this in C release via tar balls.
Change-Id: I3710076f8b7f3313cb3cb5260c4eb0a6834d4f6e Signed-off-by: Ashlee Young <ashlee@wildernessvoice.com>
Diffstat (limited to 'framework/src/audit/init.d/augenrules')
-rw-r--r--framework/src/audit/init.d/augenrules130
1 files changed, 0 insertions, 130 deletions
diff --git a/framework/src/audit/init.d/augenrules b/framework/src/audit/init.d/augenrules
deleted file mode 100644
index aa0758f6..00000000
--- a/framework/src/audit/init.d/augenrules
+++ /dev/null
@@ -1,130 +0,0 @@
-#!/bin/bash
-
-# Script to concatenate rules files found in a base audit rules directory
-# to form a single /etc/audit/audit.rules file suitable for loading into
-# the Linux audit system
-
-# When forming the interim rules file, both empty lines and comment
-# lines (starting with # or <whitespace>#) are stripped as the source files
-# are processed.
-#
-# Having formed the interim rules file, the script checks if the file is empty
-# or is identical to the existing /etc/audit/audit.rules and if either of
-# these cases are true, it does not replace the existing file
-#
-
-# Variables
-#
-# DestinationFile:
-# Destination rules file
-# SourceRulesDir:
-# Directory location to find component rule files
-# TmpRules:
-# Temporary interim rules file
-# ASuffix:
-# Suffix for previous audit.rules file if this script replaces it.
-# The file is left in the destination directory with suffix with $ASuffix
-
-DestinationFile=/etc/audit/audit.rules
-SourceRulesDir=/etc/audit/rules.d
-TmpRules=`mktemp /tmp/aurules.XXXXXXXX`
-ASuffix="prev"
-OnlyCheck=0
-LoadRules=0
-RETVAL=0
-usage="Usage: $0 [--check|--load]"
-
-# Delete the interim file on faults
-trap 'rm -f ${TmpRules}; exit 1' 1 2 3 13 15
-
-try_load() {
- if [ $LoadRules -eq 1 ] ; then
- auditctl -R ${DestinationFile}
- RETVAL=$?
- fi
-}
-
-while [ $# -ge 1 ]
-do
- if [ "$1" = "--check" ] ; then
- OnlyCheck=1
- elif [ "$1" = "--load" ] ; then
- LoadRules=1
- else
- echo "$usage"
- exit 1
- fi
- shift
-done
-
-# Check environment
-if [ ! -d ${SourceRulesDir} ]; then
- echo "$0: No rules directory - ${SourceRulesDir}"
- rm -f ${TmpRules}
- try_load
- exit 1
-fi
-
-# Create the interim rules file ensuring its access modes protect it
-# from normal users and strip empty lines and comment lines. We also ensure
-# - the last processed -D directive without an option is emitted as the first
-# line. -D directives with options are left in place
-# - the last processed -b directory is emitted as the second line
-# - the last processed -f directory is emitted as the third line
-# - the last processed -e directive is emitted as the last line
-umask 0137
-echo "## This file is automatically generated from $SourceRulesDir" >> ${TmpRules}
-for rules in $(/bin/ls -1v ${SourceRulesDir} | grep ".rules$") ; do
- cat ${SourceRulesDir}/${rules}
-done | awk '\
-BEGIN {
- minus_e = "";
- minus_D = "";
- minus_f = "";
- minus_b = "";
- rest = 0;
-} {
- if (length($0) < 1) { next; }
- if (match($0, "^\\s*#")) { next; }
- if (match($0, "^\\s*-e")) { minus_e = $0; next; }
- if (match($0, "^\\s*-D\\s*$")) { minus_D = $0; next; }
- if (match($0, "^\\s*-f")) { minus_f = $0; next; }
- if (match($0, "^\\s*-b")) { minus_b = $0; next; }
- rules[rest++] = $0;
-}
-END {
- printf "%s\n%s\n%s\n", minus_D, minus_b, minus_f;
- for (i = 0; i < rest; i++) { printf "%s\n", rules[i]; }
- printf "%s\n", minus_e;
-}' >> ${TmpRules}
-
-# If empty then quit
-if [ ! -s ${TmpRules} ]; then
- echo "$0: No rules"
- rm -f ${TmpRules}
- try_load
- exit $RETVAL
-fi
-
-# If the same then quit
-cmp -s ${TmpRules} ${DestinationFile} > /dev/null 2>&1
-if [ $? -eq 0 ]; then
- echo "$0: No change"
- rm -f ${TmpRules}
- try_load
- exit $RETVAL
-elif [ $OnlyCheck -eq 1 ] ; then
- echo "$0: Rules have changed and should be updated"
- exit 0
-fi
-
-# Otherwise we install the new file
-if [ -f ${DestinationFile} ]; then
- cp ${DestinationFile} ${DestinationFile}.prev
-fi
-# We copy the file so that it gets the right selinux lable
-cp ${TmpRules} ${DestinationFile}
-rm -f ${TmpRules}
-
-try_load
-exit $RETVAL