githubmirror/audit-userspace

rules/43-module-load.rules

6 строк398 B

Steve Grubb

Remove watches since syscall rule covers all cases

06 июл 2018, 15:56

06 июл 2018, 15:56faba74e

## These rules watch for kernel module insertion. By monitoring
## the syscall, we do not need any watches on programs.
-a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load
-a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load
-a always,exit -F arch=b32 -S delete_module -F key=module-unload
-a always,exit -F arch=b64 -S delete_module -F key=module-unload