linux audit notes

Доверенные приложения

Таблица 1. userspace-приложения, генерирующие события аудита

Приложение/RPM-пакет	Тип генерируемой записи
aide	ANOM_RBAC_INTEGRITY_FAIL
compat-glibc	USER_AVC
cronie	USER_ROLE_CHANGE USER_START
cups	LABEL_LEVEL_CHANGE LABEL_OVERRIDE USER_LABELED_EXPORT USER_UNLABELED_EXPORT USYS_CONFIG
dbus	USER_AVC
fapolicyd	FANOTIFY
gdm	USER_LOGIN USER_LOGOUT
glibc	USER_AVC
libreswan	CRYPTO_IPSEC_SA CRYPTO_IKE_SA
libsemanage	ROLE_ASSIGN ROLE_REMOVE
libvirt	VIRT_CONTROL VIRT_RESOURCE
NetworkManager	USYS_CONFIG
openssh	CRYPTO_SESSION CRYPTO_KEY_USER USER_LOGIN USER_AUTH USER_ROLE_CHANGE
pam	ANOM_EXEC ANOM_LOGIN_FAILURES RESP_ACCT_LOCK RESP_ACCT_UNLOCK_TIMED USER_ACCT USER_AUTH USER_MGMT USER_ROLE_CHANGE USER_AVC
passwd	ACCT_LOCK ACCT_UNLOCK USER_CHAUTHTOK USER_MGMT
policycoreutils	FS_RELABEL ROLE_ASSIGN ROLE_REMOVE USER_MAC_CONFIG_CHANGE USER_ROLE_CHANGE
rpm	SOFTWARE_UPDATE
shadow-utils	ADD_GROUP ADD_USER CHGRP_ID DEL_GROUP DEL_USER GRP_AUTH GRP_CHAUTHTOK GRP_MGMT ROLE_ASSIGN ROLE_REMOVE USER_ACCT USER_CHAUTHTOK USER_MGMT USYS_CONFIG
sudo	USER_CMD USER_ROLE_CHANGE
systemd	SYSTEM_BOOT SYSTEM_RUNLEVEL SYSTEM_SHUTDOWN SERVICE_START SERVICE_STOP USER_AVC USER_SELINUX_ERR
usbguard	USER_DEVICE
util-linux	USYS_CONFIG