← Back
Editing: audit-rules.service
[Unit] Description=Load Audit Rules ConditionKernelCommandLine=!audit=0 ConditionKernelCommandLine=!audit=off DefaultDependencies=no # We need the local file system for the rules. Augenrules uses /tmp while # constructing rules, so we have to wait for that to be available, too. After=local-fs.target systemd-tmpfiles-setup.service Documentation=man:auditctl(8) https://github.com/linux-audit/audit-documentation [Service] Type=oneshot ExecStart=/usr/sbin/augenrules --load # By default we don't clear the rules on exit. To enable this, uncomment the # next line after copying the file to /etc/systemd/system/audit-rules.service #ExecStopPost=/usr/sbin/auditctl -R /etc/audit/audit-stop.rules ### Security Settings ### # This won't use any security settings. They tend to interfere with # loading rules anyways. Since its a one-shot service with root owned # input, let's just load and get done. [Install] WantedBy=multi-user.target
Save File
Cancel