1#@!#!123s

JFIF 1#@!#!123s
: / lib / systemd / system /
Filename : audit-rules.service
back
[Unit]
Description=Load Audit Rules
ConditionKernelCommandLine=!audit=0
ConditionKernelCommandLine=!audit=off
DefaultDependencies=no
# We need the local file system for the rules. Augenrules uses /tmp while
# constructing rules, so we have to wait for that to be available, too.
After=local-fs.target systemd-tmpfiles-setup.service

Documentation=man:auditctl(8) https://github.com/linux-audit/audit-documentation

[Service]
Type=oneshot
ExecStart=/usr/sbin/augenrules --load

# By default we don't clear the rules on exit. To enable this, uncomment the
# next line after copying the file to /etc/systemd/system/audit-rules.service
#ExecStopPost=/usr/sbin/auditctl -R /etc/audit/audit-stop.rules

### Security Settings ###
# This won't use any security settings. They tend to interfere with
# loading rules anyways. Since its a one-shot service with root owned
# input, let's just load and get done.

[Install]
WantedBy=multi-user.target