linux audit notes

aide

ANOM_RBAC_INTEGRITY_FAIL

compat-glibc

USER_AVC

cronie

USER_ROLE_CHANGE
USER_START

cups

LABEL_LEVEL_CHANGE
LABEL_OVERRIDE
USER_LABELED_EXPORT
USER_UNLABELED_EXPORT
USYS_CONFIG

dbus

USER_AVC

fapolicyd

FANOTIFY

gdm

USER_LOGIN
USER_LOGOUT

glibc

USER_AVC

libreswan

CRYPTO_IPSEC_SA
CRYPTO_IKE_SA

libsemanage

ROLE_ASSIGN
ROLE_REMOVE

libvirt

VIRT_CONTROL
VIRT_RESOURCE

NetworkManager

USYS_CONFIG

openssh

CRYPTO_SESSION
CRYPTO_KEY_USER
USER_LOGIN
USER_AUTH
USER_ROLE_CHANGE

pam

ANOM_EXEC
ANOM_LOGIN_FAILURES
RESP_ACCT_LOCK
RESP_ACCT_UNLOCK_TIMED
USER_ACCT
USER_AUTH
USER_MGMT
USER_ROLE_CHANGE
USER_AVC

passwd

ACCT_LOCK
ACCT_UNLOCK
USER_CHAUTHTOK
USER_MGMT

policycoreutils

FS_RELABEL
ROLE_ASSIGN
ROLE_REMOVE
USER_MAC_CONFIG_CHANGE
USER_ROLE_CHANGE

rpm

SOFTWARE_UPDATE

shadow-utils

ADD_GROUP
ADD_USER
CHGRP_ID
DEL_GROUP
DEL_USER
GRP_AUTH
GRP_CHAUTHTOK
GRP_MGMT
ROLE_ASSIGN
ROLE_REMOVE
USER_ACCT
USER_CHAUTHTOK
USER_MGMT
USYS_CONFIG

sudo

USER_CMD
USER_ROLE_CHANGE

systemd

SYSTEM_BOOT
SYSTEM_RUNLEVEL
SYSTEM_SHUTDOWN
SERVICE_START
SERVICE_STOP
USER_AVC
USER_SELINUX_ERR

usbguard

USER_DEVICE

util-linux

USYS_CONFIG