Gecko [ nbspublicschool.com ]

Name	Size	Permission
10-base-config.rules	163 B	-rw-r--r--
10-no-audit.rules	284 B	-rw-r--r--
11-loginuid.rules	93 B	-rw-r--r--
12-cont-fail.rules	329 B	-rw-r--r--
12-ignore-error.rules	323 B	-rw-r--r--
20-dont-audit.rules	516 B	-rw-r--r--
21-no32bit.rules	273 B	-rw-r--r--
22-ignore-chrony.rules	252 B	-rw-r--r--
23-ignore-filesystems.rules	506 B	-rw-r--r--
30-nispom.rules	4.8 KB	-rw-r--r--
30-ospp-v42.rules	10.15 KB	-rw-r--r--
30-pci-dss-v31.rules	5.81 KB	-rw-r--r--
30-stig.rules	6.44 KB	-rw-r--r--
31-privileged.rules	1.42 KB	-rw-r--r--
32-power-abuse.rules	213 B	-rw-r--r--
40-local.rules	156 B	-rw-r--r--
41-containers.rules	439 B	-rw-r--r--
42-injection.rules	672 B	-rw-r--r--
43-module-load.rules	398 B	-rw-r--r--
70-einval.rules	326 B	-rw-r--r--
71-networking.rules	151 B	-rw-r--r--
99-finalize.rules	86 B	-rw-r--r--
README-rules	1.17 KB	-rw-r--r--

Code Editor : 31-privileged.rules

##- Use of privileged commands (unsuccessful and successful)
## You can run the following commands to generate the rules:
#find /bin -type f -perm -04000 2>/dev/null | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $1 }' > priv.rules
#find /sbin -type f -perm -04000 2>/dev/null | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $1 }' >> priv.rules
#find /usr/bin -type f -perm -04000 2>/dev/null | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $1 }' >> priv.rules
#find /usr/sbin -type f -perm -04000 2>/dev/null | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $1 }' >> priv.rules
#filecap /bin 2>/dev/null | sed '1d' | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $2 }' >> priv.rules
#filecap /sbin 2>/dev/null | sed '1d' | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $2 }' >> priv.rules
#filecap /usr/bin 2>/dev/null | sed '1d' | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $2 }' >> priv.rules
#filecap /usr/sbin 2>/dev/null | sed '1d' | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $2 }' >> priv.rules

${this.title}

Code Editor : 31-privileged.rules