A rule from auditctl lives until auditd restarts: at start the service reads its rules anew and will not remember your command.
Persistent rules live in *.rules files in /etc/audit/rules.d/. A line in a file is the same keys as auditctl, but without auditctl:
At auditd start the rules are assembled by augenrules: it merges the files from rules.d into one set and loads it. To apply the files at once, without a restart, run sudo augenrules --load; sudo auditctl -l shows the rule is there. After this the rule survives both a service restart and a reboot.
Catch who reads the key
Something reads the key /etc/shop/payment.key. Set a persistent watch for reads on it with the key paykey so the rule survives an auditd restart (a file in /etc/audit/rules.d), and load it. Within a few seconds ausearch under the paykey key must show a read of the key.
Goals · 0 of 2
- Write a persistent read rule for the key and load it not done yet
- Confirm the rule catches a read of the key not done yet