openstack/ansible-hardening
Code Issues Proposed changes
ansible-hardening/doc/source/developer-notes/V-38543.rst
Major Hayden 83cf2701eb Disable chmod auditd rules 
These rules can cause high load during periods of large changes
on a system.

Closes-bug: 1536325

Change-Id: Ic088586c3059fd0dbef06a38f2478c14e7f88702
2016-01-20 12:55:00 -06:00

448 B
Raw Blame History

Exception

The audit rules which monitor chmod, fchmod, and fchmodat syscalls can cause high CPU and I/O load during OpenStack-Ansible deployments and while updating packages with apt. By default, these rules are disabled.

These audit rules can be enabled by setting any of the following variables:

auditd_rules['DAC_chmod']: yes
auditd_rules['DAC_fchmod']: yes
auditd_rules['DAC_fchmodat']: yes