# This is a sample rule set. The rules are executed from top
# to bottom. A '#' denotes comments. The rules are basically
# the auditctl commandline parameters.

# ----- Adding syscall rules -----
# The next rule suppresses auditing for mount syscall exits. NOTE - you
# normally do not need this since events occur only when a rule causes
# them to be generated. This would make sure that the event doesn't get
# generated by another rule.
-a exit,never -S mount

# The next rule fires whenever the access syscall is entered and 
# the value of argument 1 is 4. 
-a entry,always -S access -F a1=4

# Some syscalls are multiplexed. This means that one syscall expands
# into many other subsyscalls depending on the value of an argument. 
# For example, suppose you want to audit one of the ipc subsystem
# calls, look in /usr/include/asm/ipc.h for the defines. (*NOTE: these
# numbers are platform specific. This example is for x86.) The value of
# arg0 will determine which one gets called. So, if you wanted to 
# audit SEMGET, the the rule will be:
-a exit,always -S ipc -F a0=2

# Auditing failed opens
-a exit,always -S open -F success!=0

# ----- Deleting rules -----
# Deleteing rules is basically the same as adding rules except
# you pass a -d instead. In order to delet the rule, it must
# match exactly.
# Delete rule that suppresses audit records for mount calls
-d exit,never -S mount

# Delete all rules
-D

# ----- Task rules -----
# Task rules are different in that you can only use fields that
# are known at fork time.
-a task,always -F auid=0

# The following will generate audit records when tasks are spawned and
# the auid is 501, they have su'd to root, and have wheel as a group.
-a task,always -F uid=0 -F auid=501 -F gid=wheel

# ----- File System audit rules -----
# Add a watch on "passwd" with the arbitrary filterkey "fk_passwd" that
# generates records for "reads, writes, executes, and appends" on "passwd"
-w /etc/passwd -k fk_passwd -p rwxa

# Add a watch "etc" with a NULL filterkey that generates records "reads
# and executes" on "etc"
-w /etc -p re

# Add a watch "shadow" with a NULL filterkey that has permissions 
# filtering turned off
-w /etc/shadow

# Remove the watch on "etc"
-W /etc

# ----- Configuring audit system params -----
# Set the back log to 100
-b 100

# Enable auditing
-e 1

# Configure kernel to panic when audit failure occurs
-f 2

# Limit system to 10 messages per second
-r 10

