diff --git a/tasks/auditd.yml b/tasks/auditd.yml index f3fc1fd..7d9e937 100644 --- a/tasks/auditd.yml +++ b/tasks/auditd.yml @@ -8,6 +8,17 @@ register: audit_rules_updated notify: restart auditd + +- name: POST | Set up auditd user logging exceptions + template: + src: audit/98_auditd_exception.rules.j2 + dest: /etc/audit/rules.d/98_auditd_exceptions.rules + owner: root + group: root + mode: 0600 + notify: restart auditd + when: allow_auditd_uid_user_exclusions + - name: POST | AUDITD | Discover if auditd immutable - Set reboot required if auditd immutable block: - name: POST | AUDITD | Discover if auditd immutable - will require reboot if auditd template applied diff --git a/templates/audit/98_auditd_exception.rules.j2 b/templates/audit/98_auditd_exception.rules.j2 new file mode 100644 index 0000000..b3bace1 --- /dev/null +++ b/templates/audit/98_auditd_exception.rules.j2 @@ -0,0 +1,8 @@ +## This file is managed by Ansible, YOUR CHANGED WILL BE LOST! + +# This file contains users whose actions are not logged by auditd +{% if allow_auditd_uid_user_exclusions %} +{% for user in rhel8cis_auditd_uid_exclude %} +-F uid!={{ user }} +{% endfor %} +{% endif %} \ No newline at end of file