Files
ansible-linux-infra/roles/cis_hardening/templates/audit-level2.rules.j2
2026-08-19 09:51:43 +02:00

10 lines
455 B
Django/Jinja

# {{ ansible_managed }}
-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access-denied
-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access-denied
-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k mounts
-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules