AUDISP-FILTER(8)

🎀 NAME 🎀

okay bestie, welcome to audisp-filter(8) — it's the plugin that filters your audit events and then forwards them on to other plugins. it's giving bouncer at the club door but make it sysadmin. 💅

---

✨ SYNOPSIS ✨

audisp-filter MODE CONFIG_FILE BINARY [ BINARY_ARGS ]

---

🦋 DESCRIPTION 🦋

So. audisp-filter is an audit event dispatcher plugin, and its whole personality is filtering out specific events based on the configuration you hand it. And plot twist — it can also forward the remaining logs to other plugins. queen behavior honestly.

It's universally compatible, so it slots seamlessly into literally any existing audit plugin that expects audit messages on its standard input. no drama, no fuss. 🫶

Right now it supports these arguments:

• MODE — the operational mode, and it's either allowlist or blocklist. these mode names mean exactly what's written below, no vibes-based interpretation:
  • allowlist — Forward the events that don't match. Drop the events that do match the configured ausearch expressions.
  • blocklist — Forward the events that do match the configured ausearch expressions. Drop the ones that don't match.

⚠️ Do not infer behavior from other allow/deny list terminology out there in the wild. use the definitions above. periodt. 💀

• CONFIG_FILE — the path to the main configuration file, aka the place holding your ausearch expressions.
• BINARY — the path to an external program that will consistently receive the filtered audit events through its standard input. it's always the one getting fed, iykyk. 🍓
• BINARY_ARGS — optionally, you can pass extra arguments to that external program. sprinkles on top. ✨

---

🌸 CONFIGURATION AND RULES EVALUATION 🌸

Every single plugin that wants in on the event filtering capability needs to make its own configuration file. no sharing, bestie. and it's good practice to drop that file inside the audit config directory, following the naming convention audisp-filter-pluginname.conf — for example, audisp-filter-syslog.conf if you're filtering audit events before sending them off to syslog. 💖

Each line inside a configuration represents an ausearch-expression(5). Internally, these expressions get joined together using the OR operator. So every expression is substituted with (PE || CE), where PE is the previous expression and CE is the current expression being processed. and heads up: lines starting with a # character are treated as comments and have zero influence on the final rule set. 💅

When an audit event is created, the filtering engine goes through the list of expressions and constructs the final expression that represents your rule set. Then the event in question gets searched using that expression. Whether an audit event gets forwarded to the configured binary depends on two factors: the operational mode of audisp-filter, and whether the expression actually matches the ongoing event. two-factor decision, main character energy. 👑

And this is important: filtering is event based, not record based. If any record in a multi-record audit event matches the final expression, the whole event is treated as a match. And when that event gets forwarded, all of its records are written to the configured binary — including the companion records that didn't individually match the expression. they're coming along whether they like it or not. 🙈

---

🌈 EXAMPLES 🌈

⭐ Example 1: Do not syslog audit events containing failed openat syscalls.

First, in the plugin config, make sure the operation mode is set to allowlist, the binary points to /sbin/audisp-syslog, and provide any additional arguments if needed. Next, create the plugin specific config file with the content below. And bestie — before enabling the audit plugin, always make sure the syntax is correct. You can check it by calling:

audisp-filter --check path/to/config/file

The content goes like this:

(type r= SYSCALL && syscall i= openat && success r= no)

🦋 Example 2: Forward only SERVICE_STOP events and events that contain a NETFILTER_CFG record.

Use blocklist mode and put the following expressions in the plugin specific configuration file:

type r= SERVICE_STOP
type r= NETFILTER_CFG

A NETFILTER_CFG record can be part of a multi-record event that also contains SYSCALL and PROCTITLE records with the same audit timestamp and serial. If the NETFILTER_CFG record matches, audisp-filter forwards all records in that event. A separate SERVICE_START event does not match this example and is not forwarded. sorry to that event. 😭

---

💜 FILES 💜

• /etc/audit/plugins/filter.conf
• /etc/audit/auditd.conf

---

🧚 SEE ALSO 🧚

• auditd.conf(8)
• ausearch-expression(5)
• auditd-plugins(5)

---

👑 AUTHOR 👑

Attila Lakatos

---

and that's the whole page, bestie!! this one's brought to you by Red Hat, dated February 2024. go forth and filter, you absolute icon. 💖✨🎀🦋🌸💅🫶🔥👑🌈⭐💀🙈🍓🧚💜