update monitorng

Signed-off-by: Simon Davies <[email protected]>

Author: simongdavies

.github/workflows/dep_rust.yml

@@ -106,14 +106,16 @@ jobs:
           sudo auditctl -a always,exit -F arch=b64 -S chmod,fchmod,chown,fchown,lchown,fchownat,fchmodat -k permission_syscalls || echo "Failed to add permission syscalls rule"
           
           # Monitor udev-related processes that might affect device permissions
-          sudo auditctl -a always,exit -F comm=udevd -k device_changes || echo "Failed to add udevd monitoring rule"
-          sudo auditctl -a always,exit -F comm=systemd-udevd -k device_changes || echo "Failed to add systemd-udevd monitoring rule"
+          sudo auditctl -a always,exit -F exe=/lib/systemd/systemd-udevd -k device_changes || echo "Failed to add systemd-udevd monitoring rule"
+          sudo auditctl -a always,exit -F exe=/sbin/udevd -k device_changes || echo "Failed to add udevd monitoring rule"
           
           # Monitor systemd processes that might affect devices
-          sudo auditctl -a always,exit -F comm=systemd -k device_changes || echo "Failed to add systemd monitoring rule"
+          sudo auditctl -a always,exit -F exe=/lib/systemd/systemd -k device_changes || echo "Failed to add systemd monitoring rule"
+          sudo auditctl -a always,exit -F exe=/usr/lib/systemd/systemd -k device_changes || echo "Failed to add systemd monitoring rule (alt path)"
           
           # Monitor modprobe calls (kernel module loading)
-          sudo auditctl -a always,exit -F comm=modprobe -k device_changes || echo "Failed to add modprobe monitoring rule"
+          sudo auditctl -a always,exit -F exe=/sbin/modprobe -k device_changes || echo "Failed to add modprobe monitoring rule"
+          sudo auditctl -a always,exit -F exe=/usr/sbin/modprobe -k device_changes || echo "Failed to add modprobe monitoring rule (alt path)"
           
           # Monitor file operations that might create /dev/kvm
           sudo auditctl -a always,exit -F arch=b64 -S mknod,mknodat -F path=/dev/kvm -k device_changes || echo "Failed to add device creation syscall rule"
@@ -127,12 +129,42 @@ jobs:
           sudo auditctl -s || echo "Failed to get audit status"
           
           # Check audit configuration file
-          echo "Audit configuration:"
-          if [ -f /etc/audit/auditd.conf ]; then
-            echo "auditd.conf exists, showing key settings:"
-            grep -E "^(log_file|log_format|flush|freq|max_log_file)" /etc/audit/auditd.conf || echo "Could not read audit config"
+          echo "Audit configuration search and diagnostics:"
+          
+          # Check multiple possible locations for auditd.conf
+          AUDIT_CONF_LOCATIONS="/etc/audit/auditd.conf /etc/auditd.conf /usr/local/etc/audit/auditd.conf"
+          FOUND_CONFIG=""
+          
+          for conf_path in $AUDIT_CONF_LOCATIONS; do
+            echo "Checking $conf_path..."
+            if [ -f "$conf_path" ]; then
+              echo "✓ Found auditd config at: $conf_path"
+              FOUND_CONFIG="$conf_path"
+              break
+            else
+              echo "✗ Not found: $conf_path"
+            fi
+          done
+          
+          if [ -n "$FOUND_CONFIG" ]; then
+            echo "Reading audit configuration from: $FOUND_CONFIG"
+            if sudo cat "$FOUND_CONFIG" >/dev/null 2>&1; then
+              echo "Key audit settings:"
+              sudo grep -E "^(log_file|log_format|flush|freq|max_log_file)" "$FOUND_CONFIG" || echo "Could not find standard config keys"
+            else
+              echo "Permission denied reading $FOUND_CONFIG - trying with elevated privileges"
+              sudo ls -la "$FOUND_CONFIG" || echo "Cannot access config file"
+            fi
           else
-            echo "auditd.conf not found"
+            echo "No auditd.conf found in standard locations"
+            echo "Checking /etc/audit/ directory permissions:"
+            sudo ls -la /etc/audit/ || echo "Cannot access /etc/audit/ directory"
+            
+            echo "Checking if auditd package is properly installed:"
+            dpkg -l | grep audit || echo "No audit packages found"
+            
+            echo "Looking for any audit-related config files:"
+            sudo find /etc -name "*audit*" -type f 2>/dev/null | head -10 || echo "No audit config files found"
           fi
           
           # Ensure audit logs are writable