>From 5d71d4834d8fb78495d99936140f718d979d22c6 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Tue, 21 Feb 2012 23:06:25 -0500 Subject: [PATCH 11/11] - Minor changes to audit_config_immutable --- rhel6/src/input/system/auditing.xml | 10 ++++------ 1 files changed, 4 insertions(+), 6 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 71d70b7..9243d13 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -392,16 +392,14 @@ to have an audit trail of modules that have been introduced into the kernel. Make the <tt>auditd</tt> Configuration Immutable -Add the following to /etc/audit/audit.rules in order +Add the following to the bottom of your /etc/audit/audit.rules in order to make the configuration immutable:
-
+
# audit_config_immutable
 -e 2
 
-With this setting, a reboot will be required to change any -audit rules. -Making the audit configuration immutable prevents the accidential as -well as malicious modification of the audit rules. +With this setting, a reboot will be required to change any audit rules. +Making the audit configuration immutable prevents accidential as well as malicious modification of the audit rules. -- 1.7.1