Commit 38c5884e authored by ale's avatar ale
Browse files

Ignore system users cron from audit rules

parent 17cd5fd6
Pipeline #16621 passed with stage
in 6 minutes and 19 seconds
......@@ -8,6 +8,9 @@
-a never,user -F msgtype=CRED_REFR -F auid=-1
-a never,exit -F exe=/usr/sbin/cron -F auid=-1
# No crons from system users either.
-a never,exit -F exe=/usr/sbin/cron -F auid<1000
# Note: the following section has been disabled because
# we use audisp-json that does event aggregation, and
# actually makes use of EOE, CWD, PATH and the rest of
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment