From 8b770013fd7f8cb44e3823692f27c1c2ae84a24d Mon Sep 17 00:00:00 2001 From: Samson-W Date: Thu, 22 Nov 2018 04:19:57 -0500 Subject: [PATCH] Remove auditd item for umount syscall --- bin/hardening/8.1.13_record_successful_mount.sh | 2 -- 1 file changed, 2 deletions(-) diff --git a/bin/hardening/8.1.13_record_successful_mount.sh b/bin/hardening/8.1.13_record_successful_mount.sh index 9f30652..47a6310 100755 --- a/bin/hardening/8.1.13_record_successful_mount.sh +++ b/bin/hardening/8.1.13_record_successful_mount.sh @@ -15,8 +15,6 @@ HARDENING_LEVEL=4 AUDIT_PARAMS='-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts -a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts --a always,exit -F arch=b64 -S umount -F auid>=1000 -F auid!=4294967295 -k mounts --a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=4294967295 -k mounts' FILE='/etc/audit/rules.d/audit.rules'