Le 11/08/16 à 22:06, Patrick Schleizer a écrit :
Laurent Bigonville:
Could /etc/audit/rules.d/ be processed by default?
This is already the case since 1:2.5.2-1
Updated from sid.
Unpacking auditd (1:2.6.5-1) over (1:2.4-1+b1) ...
Not the case.
/lib/systemd/system/auditd.service
[...]
## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
ExecStartPost=-/sbin/augenrules --load
This line is compiling the configuration using the files in
/etc/audit/rules.d/ and then loading the rules in the daemon.
