|
|
Unix file, folder permissions, security auditing tools.
|
|
|
|
audit.conf(4) Kernel Interfaces Manual audit.conf(4) NAME
audit.conf, audit_site.conf - files containing event mapping information and site-specific event mapping information DESCRIPTION
Files and store the event mapping information that can be used by and An event is a particular system operation. It may be either a self-auditing event or a system call. Auditable events are classified into several event categories and/or profiles. Events and system calls may have aliases. When the auditing system is installed, a default set of event mapping information is provided in In order to meet site-specific require- ments, users may also define event categories and profiles in In general, an event category is defined as a set of operations that affect a particular aspect of the system. A profile is defined as a set of operations that affect a particular type of system. With these classifications, a set of events can be selected when using or by specifying the event category or the profile that the events are associated with. Here is the syntax of the directives in and Event categories are defined using the directive for base events and the directive for event aliases. Base events are events that are pre-defined by the HP-UX operating system. They are always associated with self-auditing events that have the same name and/or with a list of system calls with the names that are referred to by the HP-UX auditing system. Event aliases, distinct from base events, are combinations of base events, self-auditing events, system calls, and system call aliases. The system call name referred to by the auditing system usually matches the real system call name with a few exceptions. If the system call is one of these exceptions, an alias name may be defined using the directive, and the alias name can be used by and system call level selection. For example, the system call is referred to as the system call by the auditing system. The interface of is not publicly exported, but the security relevant information of this system call is described in this file documents the security relevant information for all system calls that have names beginning with a period Profiles are defined using the directive. Profiles can be combinations of any events. In only and directives are allowed; names picked for or must begin with a uppercase character and must have at least one lowercase charac- ter. Adding or at the end of an event name indicates only include successful or failed operations. EXAMPLES
Here are some example entries that could be in Selecting for auditing enables audit for the system calls (for both pass and fail), (for pass only), and (for fail only). Note that con- tains and the fail events covered under Selecting this profile causes to be audited for both pass and fail, and to be audited for fail, and to not be audited at all. AUTHOR
was developed by HP. FILES
File containing event mapping information File containing audit information description for HP-UX internal system calls which are not publicly supported File containing site-specific event mapping information SEE ALSO
audevent(1M), audisp(1M). audit.conf(4)
