From 80bd0578faed22c5b512360005f62e3ff1b7f2a6 Mon Sep 17 00:00:00 2001 From: Cropi Date: Thu, 9 Oct 2025 08:49:17 +0200 Subject: [PATCH] Add explanatory comment for /boot/grub2/grubenv exclusion Document why /boot/grub2/grubenv is excluded from AIDE monitoring. The file's timestamp gets modified continuously due to the "boot_success" implementation, which would cause unnecessary noise in security monitoring reports. Do not monitor link count in /var/log/journal. Resolves: RHEL-83776 --- aide.conf | 4 +++- aide.spec | 6 +++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/aide.conf b/aide.conf index fe5a0a2..6c9431a 100644 --- a/aide.conf +++ b/aide.conf @@ -363,4 +363,6 @@ DATAONLY = ftype+p+l+n+u+g+s+acl+selinux+xattrs+sha256 #=/home DIR # Ditto /var/log/sa reason... -!/var/log/httpd \ No newline at end of file +!/var/log/httpd +# /boot/grub2/grubenv's timestamp is getting modified continuously due to "boot_success" implementation +!/boot/grub2/grubenv diff --git a/aide.spec b/aide.spec index 4baa170..1fc33cf 100644 --- a/aide.spec +++ b/aide.spec @@ -1,7 +1,7 @@ Summary: Intrusion detection environment Name: aide Version: 0.19.2 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://github.com/aide/aide License: GPLv2+ @@ -81,6 +81,10 @@ install -Dpm0644 %{SOURCE6} %{buildroot}%{_tmpfilesdir}/aide.conf %{_tmpfilesdir}/aide.conf %changelog +* Thu Oct 09 2025 Attila Lakatos - 0.19.2-4 +- /boot/grub2/grubenv is excluded from check due to boot_success implementation +Resolves: RHEL-83776 + * Tue Sep 30 2025 Attila Lakatos - 0.19.2-3 - Do not monitor link count in /var/log/journal Resolves: RHEL-83776