0

I need to match a regex against the output of 'auditctl -l' command. From the several checks I conducted I saw a difference in output convention writing in different audit versions (for the same audit rules):

  • On Ubuntu 18.04 with auditd 1.7.18 I got the following output for 'auditctl -l':
    LIST_RULES: exit,always dir=/var/lib/docker (0xf) perm=rwxa key=docker 
    LIST_RULES: exit,always watch=/usr/bin/docker perm=rwxa key=docker 
    LIST_RULES: exit,always dir=/etc/docker (0xb) perm=rwxa key=docker 
    LIST_RULES: exit,always watch=/lib/systemd/system/docker.service perm=rwxa key=docker 
    LIST_RULES: exit,always watch=/lib/systemd/system/docker.socket perm=rwxa key=docker 
    LIST_RULES: exit,always watch=/etc/default/docker perm=rwxa key=docker 
    LIST_RULES: exit,always watch=/etc/docker/daemon.json perm=rwxa key=docker 
    LIST_RULES: exit,always watch=/usr/bin/docker-containerd perm=rwxa key=docker 
    LIST_RULES: exit,always watch=/usr/bin/docker-runc perm=rwxa key=docker
  • On Ubuntu 18.04 with auditd 2.8.2 I got the following output for 'auditctl -l':
    -w /usr/bin/docker -p rwxa -k docker 
    -w /var/lib/docker -p rwxa -k docker 
    -w /etc/docker -p rwxa -k docker 
    -w /lib/systemd/system/docker.service -p rwxa -k docker 
    -w /lib/systemd/system/docker.socket -p rwxa -k docker 
    -w /etc/default/docker -p rwxa -k docker 
    -w /etc/docker/daemon.json -p rwxa -k docker 
    -w /usr/bin/docker-containerd -p rwxa -k docker 
    -w /usr/bin/docker-runc -p rwxa -k docker

Are there other options for output writing convention? Maybe in other Linux distributions? And how can I know (is there a manual or other documentation)?

  • perhaps you didn't mean Ubuntu in the first bullet, since that's an old version. The developers of auditd don't give a lot of documentation, in any case. – Thomas Dickey Jan 9 at 21:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.