JFIF$        dd7 

Viewing File: /usr/sbin/augenrules

#!/usr/bin/sh

# Script to concatenate rules files found in a base audit rules directory
# to form a single /etc/audit/audit.rules file suitable for loading into
# the Linux audit system

# When forming the interim rules file, both empty lines and comment
# lines (starting with # or <whitespace>#) are stripped as the source files
# are processed.
#
# Having formed the interim rules file, the script checks if the file is empty
# or is identical to the existing /etc/audit/audit.rules and if either of
# these cases are true, it does not replace the existing file
#

# Variables
#
# DestinationFile:
#   Destination rules file
# SourceRulesDir:
#   Directory location to find component rule files
# TmpRules:
#   Temporary interim rules file
# ASuffix:
#   Suffix for previous audit.rules file if this script replaces it.
#   The file is left in the destination directory with suffix with $ASuffix

DestinationFile=/etc/audit/audit.rules
SourceRulesDir=/etc/audit/rules.d
TmpRules=$(mktemp /tmp/aurules.XXXXXXXX)
ASuffix="prev"
OnlyCheck=0
LoadRules=0
RETVAL=0
cmd="$0"
usage="Usage: $cmd [--check|--load]"

# Delete the interim file on faults
trap 'rm -f ${TmpRules}; exit 1' HUP INT QUIT PIPE TERM

try_load() {
	if [ $LoadRules -eq 1 ] ; then
		/sbin/auditctl -R ${DestinationFile}
		RETVAL=$?
	fi
}

# Check if audit is in immutable mode - exit if so
check_immutable () {
    if [ "$(auditctl -s | awk '$1 == "enabled" { print $2 }')" = "2" ] ; then
	echo "$cmd: Audit system is in immutable mode - exiting with no changes"
	exit 0
    fi
}

while [ $# -ge 1 ]
do
	if [ "$1" = "--check" ] ; then
		OnlyCheck=1
	elif [ "$1" = "--load" ] ; then
		LoadRules=1
	else
		echo "$usage"
		exit 1
	fi
	shift
done

# Check environment
if [ ! -d ${SourceRulesDir} ]; then
	echo "$cmd: No rules directory - ${SourceRulesDir}"
	rm -f "${TmpRules}"
	try_load
	exit 1
fi

# Create the interim rules file ensuring its access modes protect it
# from normal users and strip empty lines and comment lines. We also ensure
#   - the last processed -D directive without an option is emitted as the first
#     line. -D directives with options are left in place
#   - the last processed -b directory is emitted as the second line
#   - the last processed -f directory is emitted as the third line
#   - the last processed -e directive is emitted as the last line
umask 0137
echo "## This file is automatically generated from $SourceRulesDir" >> "${TmpRules}"
for rules in $(/bin/ls -1v ${SourceRulesDir} | grep "\.rules$") ; do
	cat ${SourceRulesDir}/"${rules}"
done | awk '
BEGIN   {
        minus_e = "";
        minus_D = "";
        minus_f = "";
        minus_b = "";
        rest = 0;
} {
        sub(/\r$/, "");
        if (length($0) < 1) { next; }
        if (match($0, "^\\s*#")) { next; }
        if (match($0, "^\\s*-e")) { minus_e = $0; next; }
        if (match($0, "^\\s*-D\\s*$")) { minus_D = $0; next; }
        if (match($0, "^\\s*-f")) { minus_f = $0; next; }
        if (match($0, "^\\s*-b")) { minus_b = $0; next; }
        rules[rest++] = $0;
}
END     {
        printf "%s\n%s\n%s\n", minus_D, minus_b, minus_f;
        for (i = 0; i < rest; i++) { printf "%s\n", rules[i]; }
        printf "%s\n", minus_e;
}' >> "${TmpRules}"

# If empty then quit
if [ ! -s "${TmpRules}" ]; then
	echo "$cmd: No rules"
	rm -f "${TmpRules}"
	try_load
	exit $RETVAL
fi

# If the same then quit
cmp -s "${TmpRules}" ${DestinationFile} > /dev/null 2>&1
if [ $? -eq 0 ]; then
	echo "$cmd: No change"
	rm -f "${TmpRules}"
	check_immutable
	try_load
	exit $RETVAL
elif [ $OnlyCheck -eq 1 ] ; then
	echo "$cmd: Rules have changed and should be updated"
	rm -f "${TmpRules}"
	exit 0
fi

# Otherwise we install the new file
check_immutable
if [ -f ${DestinationFile} ]; then
	cp ${DestinationFile} ${DestinationFile}.${ASuffix}
fi
# We copy the file so that it gets the right selinux lable
cp "${TmpRules}" ${DestinationFile}
chmod 0640 ${DestinationFile}
# Restore context on MLS system. /tmp is SystemLow & audit.rules is SystemHigh
if [ -x /usr/sbin/restorecon ] ; then
	/usr/sbin/restorecon -F ${DestinationFile}
fi
rm -f "${TmpRules}"

try_load
exit $RETVAL
Back to Directory  nL+D550H?Mx ,D"v]qv;6*Zqn)ZP0!1 A "#a$2Qr D8 a Ri[f\mIykIw0cuFcRı?lO7к_f˓[C$殷WF<_W ԣsKcëIzyQy/_LKℂ;C",pFA:/]=H  ~,ls/9ć:[=/#f;)x{ٛEQ )~ =𘙲r*2~ a _V=' kumFD}KYYC)({ *g&f`툪ry`=^cJ.I](*`wq1dđ#̩͑0;H]u搂@:~וKL Nsh}OIR*8:2 !lDJVo(3=M(zȰ+i*NAr6KnSl)!JJӁ* %݉?|D}d5:eP0R;{$X'xF@.ÊB {,WJuQɲRI;9QE琯62fT.DUJ;*cP A\ILNj!J۱+O\͔]ޒS߼Jȧc%ANolՎprULZԛerE2=XDXgVQeӓk yP7U*omQIs,K`)6\G3t?pgjrmۛجwluGtfh9uyP0D;Uڽ"OXlif$)&|ML0Zrm1[HXPlPR0'G=i2N+0e2]]9VTPO׮7h(F*癈'=QVZDF,d߬~TX G[`le69CR(!S2!P <0x<!1AQ "Raq02Br#SCTb ?Ζ"]mH5WR7k.ۛ!}Q~+yԏz|@T20S~Kek *zFf^2X*(@8r?CIuI|֓>^ExLgNUY+{.RѪ τV׸YTD I62'8Y27'\TP.6d&˦@Vqi|8-OΕ]ʔ U=TL8=;6c| !qfF3aů&~$l}'NWUs$Uk^SV:U# 6w++s&r+nڐ{@29 gL u"TÙM=6(^"7r}=6YݾlCuhquympǦ GjhsǜNlɻ}o7#S6aw4!OSrD57%|?x>L |/nD6?/8w#[)L7+6〼T ATg!%5MmZ/c-{1_Je"|^$'O&ޱմTrb$w)R$& N1EtdU3Uȉ1pM"N*(DNyd96.(jQ)X 5cQɎMyW?Q*!R>6=7)Xj5`J]e8%t!+'!1Q5 !1 AQaqё#2"0BRb?Gt^## .llQT $v,,m㵜5ubV =sY+@d{N! dnO<.-B;_wJt6;QJd.Qc%p{ 1,sNDdFHI0ГoXшe黅XۢF:)[FGXƹ/w_cMeD,ʡcc.WDtA$j@:) -# u c1<@ۗ9F)KJ-hpP]_x[qBlbpʖw q"LFGdƶ*s+ډ_Zc"?%t[IP 6J]#=ɺVvvCGsGh1 >)6|ey?Lӣm,4GWUi`]uJVoVDG< SB6ϏQ@ TiUlyOU0kfV~~}SZ@*WUUi##; s/[=!7}"WN]'(L! ~y5g9T̅JkbM' +s:S +B)v@Mj e Cf jE 0Y\QnzG1д~Wo{T9?`Rmyhsy3!HAD]mc1~2LSu7xT;j$`}4->L#vzŏILS ֭T{rjGKC;bpU=-`BsK.SFw4Mq]ZdHS0)tLg