Yocto 审核守护程序不从Audit.rules获取规则

我无法使用/etc/audit/audit.rules向审核守护进程添加规则 每次我使用auditctl添加规则时，它在重新启动或审计守护进程重新启动时被删除，我都会附加/etc/audit/audit.rules和/etc/audit/auditd.conf cat/etc/audit/auditd.conf

$ cat /etc/audit/auditd.conf 
#
# This file controls the configuration of the audit daemon
#

local_events = yes
write_logs = yes
log_file = /NU_Application/audit.log
log_group = root
log_format = RAW
flush = INCREMENTAL_ASYNC
freq = 50
max_log_file = 8
num_logs = 5
priority_boost = 4
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = NONE
##name = mydomain
max_log_file_action = ROTATE
space_left = 75
space_left_action = SYSLOG
verify_email = yes
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND
use_libwrap = yes
##tcp_listen_port = 22
tcp_listen_queue = 5
tcp_max_per_addr = 1
##tcp_client_ports = 1024-65535
tcp_client_max_idle = 0
enable_krb5 = no
krb5_principal = auditd
##krb5_key_file = /etc/audit/audit.key
distribute_network = no

$ cat /etc/audit/audit.rules 
## First rule - delete all

## Increase the buffers to survive stress events.
## Make this bigger for busy systems
-b 8192

## This determine how long to wait in burst of events
--backlog_wait_time 0

## Set failure mode to syslog
-f 1
-w /var/log/lastlog -p wa
root@iWave-G22M:~# auditctl 

cat/etc/audit/audit.rules

$ cat /etc/audit/auditd.conf 
#
# This file controls the configuration of the audit daemon
#

local_events = yes
write_logs = yes
log_file = /NU_Application/audit.log
log_group = root
log_format = RAW
flush = INCREMENTAL_ASYNC
freq = 50
max_log_file = 8
num_logs = 5
priority_boost = 4
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = NONE
##name = mydomain
max_log_file_action = ROTATE
space_left = 75
space_left_action = SYSLOG
verify_email = yes
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND
use_libwrap = yes
##tcp_listen_port = 22
tcp_listen_queue = 5
tcp_max_per_addr = 1
##tcp_client_ports = 1024-65535
tcp_client_max_idle = 0
enable_krb5 = no
krb5_principal = auditd
##krb5_key_file = /etc/audit/audit.key
distribute_network = no

$ cat /etc/audit/audit.rules 
## First rule - delete all

## Increase the buffers to survive stress events.
## Make this bigger for busy systems
-b 8192

## This determine how long to wait in burst of events
--backlog_wait_time 0

## Set failure mode to syslog
-f 1
-w /var/log/lastlog -p wa
root@iWave-G22M:~# auditctl 

当我重新启动审计守护进程（即/etc/init.d/auditd restart）并尝试列出规则时，我会收到消息No rules

$ /etc/init.d/auditd restart
Restarting audit daemon auditd
type=1305 audit(1558188111.980:3): audit_pid=0 old=1148 auid=4294967295 ses=4294967295
 res=1
type=1305 audit(1558188112.010:4): audit_enabled=1 old=1 auid=4294967295 ses=4294967295
 res=1
type=1305 audit(1558188112.020:5): audit_pid=30342 old=0 auid=4294967295 ses=4294967295
 res=1
1
$ auditctl -l               
No rules

操作系统信息

$ uname -a
Linux iWave-G22M 3.10.31-ltsi-svn743 #5 SMP PREEMPT Mon May 27 18:28:01 IST 2019 armv7l GNU/Linux

audit_2.8.4.bb文件用于通过yocto安装auditd守护进程

---

审核路径_2.8.4.bb--

审核规则通过/etc/audit/audit添加。规则和审核ctl命令不是永久性的。要使它们在整个重启过程中保持永久性，您必须将它们添加到/etc/audit/rules.d/audit.rules文件中。 添加规则后，重新启动auditd服务并运行命令auditctl-l，它将列出所有规则，并反映在/etc/audit/audit.rules文件中