[SOLVED] - audit rules for printing

Support for security such as Firewalls and securing linux
Post Reply
User avatar
warron.french
Posts: 616
Joined: 2014/03/27 20:21:58

[SOLVED] - audit rules for printing

Post by warron.french » 2018/05/01 18:25:50

How do I audit:
1. Print to file, and
2. Print to device,

FROM
A. terminal session or cli, and
B. GUI / Firefox (for example)?

Is there an ausyscall that can be monitored in audit.rules?
Last edited by warron.french on 2018/05/02 18:45:40, edited 1 time in total.
Thanks,
War

User avatar
warron.french
Posts: 616
Joined: 2014/03/27 20:21:58

Re: audit rules for printing

Post by warron.french » 2018/05/02 18:45:21

I learned from Steve Grubb that cupsd is hardwired for audting already.

You can confirm this by:
ldd /usr/sbin/cups | grep audit
libaudit.so.1 => /lib64/libaudit.so.1 (0x00007f04f1cfa000)

What this means is you don't have to put in an explicit rule into the /etc/audit/rules.d/audit.rules file on redhat 7; or for redhat 6 machines into the /etc/audit/audit.rules file.
Thanks,
War

Post Reply