1*4882a593Smuzhiyun#!/bin/sh 2*4882a593Smuzhiyun# 3*4882a593Smuzhiyun# auditd This starts and stops auditd 4*4882a593Smuzhiyun# 5*4882a593Smuzhiyun# description: This starts the Linux Auditing System Daemon, 6*4882a593Smuzhiyun# which collects security related events in a dedicated 7*4882a593Smuzhiyun# audit log. If this daemon is turned off, audit events 8*4882a593Smuzhiyun# will be sent to syslog. 9*4882a593Smuzhiyun# 10*4882a593Smuzhiyun 11*4882a593SmuzhiyunNAME=auditd 12*4882a593SmuzhiyunDAEMON=/usr/sbin/${NAME} 13*4882a593SmuzhiyunCONFIG=/etc/audit/auditd.conf 14*4882a593SmuzhiyunPIDFILE=/var/run/${NAME}.pid 15*4882a593Smuzhiyun 16*4882a593Smuzhiyunstart(){ 17*4882a593Smuzhiyun printf "Starting ${NAME}: " 18*4882a593Smuzhiyun 19*4882a593Smuzhiyun # Create dir to store log files in if one doesn't exist. Create 20*4882a593Smuzhiyun # the directory with SELinux permissions if possible 21*4882a593Smuzhiyun command -v selabel_lookup >/dev/null 2>&1 22*4882a593Smuzhiyun if [ $? = 0 ]; then 23*4882a593Smuzhiyun mkdir -p /var/log/audit -Z `selabel_lookup -b file -k /var/log/audit | cut -d ' ' -f 3` 24*4882a593Smuzhiyun else 25*4882a593Smuzhiyun mkdir -p /var/log/audit 26*4882a593Smuzhiyun fi 27*4882a593Smuzhiyun 28*4882a593Smuzhiyun # Run audit daemon executable 29*4882a593Smuzhiyun start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON} 30*4882a593Smuzhiyun 31*4882a593Smuzhiyun if [ $? = 0 ]; then 32*4882a593Smuzhiyun # Load the default rules 33*4882a593Smuzhiyun test -f /etc/audit/rules.d/audit.rules && /usr/sbin/auditctl -R /etc/audit/rules.d/audit.rules >/dev/null 34*4882a593Smuzhiyun echo "OK" 35*4882a593Smuzhiyun else 36*4882a593Smuzhiyun echo "FAIL" 37*4882a593Smuzhiyun fi 38*4882a593Smuzhiyun} 39*4882a593Smuzhiyun 40*4882a593Smuzhiyunstop(){ 41*4882a593Smuzhiyun printf "Stopping ${NAME}: " 42*4882a593Smuzhiyun 43*4882a593Smuzhiyun start-stop-daemon -K -q -p ${PIDFILE} 44*4882a593Smuzhiyun [ $? = 0 ] && echo "OK" || echo "FAIL" 45*4882a593Smuzhiyun} 46*4882a593Smuzhiyun 47*4882a593Smuzhiyunreload(){ 48*4882a593Smuzhiyun printf "Reloading ${NAME} configuration: " 49*4882a593Smuzhiyun start-stop-daemon --stop -s 1 -p ${PIDFILE} 1>/dev/null 50*4882a593Smuzhiyun [ $? = 0 ] && echo "OK" || echo "FAIL" 51*4882a593Smuzhiyun} 52*4882a593Smuzhiyun 53*4882a593Smuzhiyunrotate(){ 54*4882a593Smuzhiyun printf "Rotating ${NAME} logs: " 55*4882a593Smuzhiyun start-stop-daemon --stop -s 10 -p ${PIDFILE} 1>/dev/null 56*4882a593Smuzhiyun [ $? = 0 ] && echo "OK" || echo "FAIL" 57*4882a593Smuzhiyun} 58*4882a593Smuzhiyun 59*4882a593Smuzhiyuncase "$1" in 60*4882a593Smuzhiyun start) 61*4882a593Smuzhiyun start 62*4882a593Smuzhiyun ;; 63*4882a593Smuzhiyun stop) 64*4882a593Smuzhiyun stop 65*4882a593Smuzhiyun ;; 66*4882a593Smuzhiyun restart) 67*4882a593Smuzhiyun stop 68*4882a593Smuzhiyun start 69*4882a593Smuzhiyun ;; 70*4882a593Smuzhiyun reload) 71*4882a593Smuzhiyun reload 72*4882a593Smuzhiyun ;; 73*4882a593Smuzhiyun rotate) 74*4882a593Smuzhiyun rotate 75*4882a593Smuzhiyun ;; 76*4882a593Smuzhiyun *) 77*4882a593Smuzhiyun echo "Usage: $0 {start|stop|restart|reload|rotate}" 78*4882a593Smuzhiyun exit 1 79*4882a593Smuzhiyun ;; 80*4882a593Smuzhiyunesac 81