add stime audit rule

2024-04-08 11:57:14 -07:00 · 2024-04-08 11:57:14 -07:00 · 347dc10d88
commit 347dc10d88
parent cfdb44c204
1 changed files with 1 additions and 0 deletions
--- a/templates/etc/audit/rules.d/collection.rules.j2
+++ b/templates/etc/audit/rules.d/collection.rules.j2
@ -3,6 +3,7 @@

 -a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime -k time-change
 -a always,exit -F arch=b32 -S adjtimex,settimeofday,clock_settime -k time-change
+-a always,exit -F arch=b32 -S stime -F key=audit_time_rule
 -w /etc/localtime -p wa -k time-change

 ## Records when events occur that modify user and group passwords and ID's