On Wed, May 25, 2011 at 4:23 AM, Mr Dash Four <mr.dash.four@googlemail.com> wrote:

> You are only excluding 'user' messages.  I don't know the list of which
> msg types are 'user' messages off the top of my head, but it isn't that
> long.  I don't believe that crond sends any other user messages (but it
> wouldn't be the first time I was wrong).  You would still audit things
> like AVC denials for cron or or any syscall audit rules you have.
> Basically that is going to deny all audit messages that cron explicitly
> sent to the audit system, but not messages generated by the kernel for cron.
>
I can't really answer whether this is good or not then, as 1) my auditd
knowledge is still limited and 2) I do not really know what these "user
messages" actually cover (is there a definite list of these?). I would
like to disable the following types for sure: USER_ACCT, CRED_ACQ,
USER_START, CRED_DISP and USER_END.
I have found this reference very useful:

http://people.redhat.com/sgrubb/audit/summit07_audit_ids.odp


This shows where events come from and which filters they hit. The cron event comes

from user space. It goes through the user filter, so that where the rule would

need to be. The only valid fields for this filter are (from auditctl(8))

user Add a rule to the user message filter list. This list is used by the kernel to filter events originating in user space before
relaying them to the audit daemon. It should be noted that the only fields that are valid are: uid, auid, gid, pid, subj_user,
subj_role, subj_type, subj_sen, and subj_clr. All other fields will be treated as non-matching.

Dunno if this can help you. IMHO i think no.

Regards