1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
|
#!/bin/bash
# Script to concatenate rules files found in a base audit rules directory
# to form a single /etc/audit/audit.rules file suitable for loading into
# the Linux audit system
# When forming the interim rules file, both empty lines and comment
# lines (starting with # or <whitespace>#) are stripped as the source files
# are processed.
#
# Having formed the interim rules file, the script checks if the file is empty
# or is identical to the existing /etc/audit/audit.rules and if either of
# these cases are true, it does not replace the existing file
#
# Variables
#
# DestinationFile:
# Destination rules file
# SourceRulesDir:
# Directory location to find component rule files
# TmpRules:
# Temporary interim rules file
# ASuffix:
# Suffix for previous audit.rules file if this script replaces it.
# The file is left in the destination directory with suffix with $ASuffix
DestinationFile=/etc/audit/audit.rules
SourceRulesDir=/etc/audit/rules.d
TmpRules=`mktemp /tmp/aurules.XXXXXXXX`
ASuffix="prev"
OnlyCheck=0
LoadRules=0
RETVAL=0
usage="Usage: $0 [--check|--load]"
# Delete the interim file on faults
trap 'rm -f ${TmpRules}; exit 1' 1 2 3 13 15
try_load() {
if [ $LoadRules -eq 1 ] ; then
auditctl -R ${DestinationFile}
RETVAL=$?
fi
}
while [ $# -ge 1 ]
do
if [ "$1" = "--check" ] ; then
OnlyCheck=1
elif [ "$1" = "--load" ] ; then
LoadRules=1
else
echo "$usage"
exit 1
fi
shift
done
# Check environment
if [ ! -d ${SourceRulesDir} ]; then
echo "$0: No rules directory - ${SourceRulesDir}"
rm -f ${TmpRules}
try_load
exit 1
fi
# Create the interim rules file ensuring its access modes protect it
# from normal users and strip empty lines and comment lines. We also ensure
# - the last processed -D directive without an option is emitted as the first
# line. -D directives with options are left in place
# - the last processed -b directory is emitted as the second line
# - the last processed -f directory is emitted as the third line
# - the last processed -e directive is emitted as the last line
umask 0137
echo "## This file is automatically generated from $SourceRulesDir" >> ${TmpRules}
for rules in $(/bin/ls -1v ${SourceRulesDir} | grep ".rules$") ; do
cat ${SourceRulesDir}/${rules}
done | awk '\
BEGIN {
minus_e = "";
minus_D = "";
minus_f = "";
minus_b = "";
rest = 0;
} {
if (length($0) < 1) { next; }
if (match($0, "^\\s*#")) { next; }
if (match($0, "^\\s*-e")) { minus_e = $0; next; }
if (match($0, "^\\s*-D\\s*$")) { minus_D = $0; next; }
if (match($0, "^\\s*-f")) { minus_f = $0; next; }
if (match($0, "^\\s*-b")) { minus_b = $0; next; }
rules[rest++] = $0;
}
END {
printf "%s\n%s\n%s\n", minus_D, minus_b, minus_f;
for (i = 0; i < rest; i++) { printf "%s\n", rules[i]; }
printf "%s\n", minus_e;
}' >> ${TmpRules}
# If empty then quit
if [ ! -s ${TmpRules} ]; then
echo "$0: No rules"
rm -f ${TmpRules}
try_load
exit $RETVAL
fi
# If the same then quit
cmp -s ${TmpRules} ${DestinationFile} > /dev/null 2>&1
if [ $? -eq 0 ]; then
echo "$0: No change"
rm -f ${TmpRules}
try_load
exit $RETVAL
elif [ $OnlyCheck -eq 1 ] ; then
echo "$0: Rules have changed and should be updated"
exit 0
fi
# Otherwise we install the new file
if [ -f ${DestinationFile} ]; then
cp ${DestinationFile} ${DestinationFile}.prev
fi
# We copy the file so that it gets the right selinux lable
cp ${TmpRules} ${DestinationFile}
rm -f ${TmpRules}
try_load
exit $RETVAL
|
