rpms/aide
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Add explanatory comment for /boot/grub2/grubenv exclusion

Browse Source 
Document why /boot/grub2/grubenv is excluded from AIDE monitoring.  The
file's timestamp gets modified continuously due to the "boot_success"
implementation, which would cause unnecessary noise in security
monitoring reports.
Do not monitor link count in /var/log/journal.

Resolves: RHEL-83776
This commit is contained in:
Cropi 2025-10-09 08:49:17 +02:00
parent 3a6519a69a
commit 80bd0578fa
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
aide.conf
View File

@ -363,4 +363,6 @@ DATAONLY = ftype+p+l+n+u+g+s+acl+selinux+xattrs+sha256
#=/home DIR
# Ditto /var/log/sa reason...
!/var/log/httpd
!/var/log/httpd
# /boot/grub2/grubenv's timestamp is getting modified continuously due to "boot_success" implementation
!/boot/grub2/grubenv

6
aide.spec
View File

@ -1,7 +1,7 @@
Summary: Intrusion detection environment
Name: aide
Version: 0.19.2
Release: 3%{?dist}
Release: 4%{?dist}
URL: https://github.com/aide/aide
License: GPLv2+
@ -81,6 +81,10 @@ install -Dpm0644 %{SOURCE6} %{buildroot}%{_tmpfilesdir}/aide.conf
%{_tmpfilesdir}/aide.conf
%changelog
* Thu Oct 09 2025 Attila Lakatos <alakatos@redhat.com> - 0.19.2-4
- /boot/grub2/grubenv is excluded from check due to boot_success implementation
Resolves: RHEL-83776
* Tue Sep 30 2025 Attila Lakatos <alakatos@redhat.com> - 0.19.2-3
- Do not monitor link count in /var/log/journal
Resolves: RHEL-83776