Bug 1962029

Summary:	[RFE] implement selinux audit log filtering for syslog plugin
Product:	Red Hat Enterprise Linux 8	Reporter:	dbodnarc
Component:	audit	Assignee:	Sergio Correia <scorreia>
Status:	NEW ---	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	8.5	CC:	dapospis, jsantos, scorreia, sgrubb
Target Milestone:	beta	Keywords:	FutureFeature, RFE, Triaged
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description dbodnarc 2021-05-19 08:45:35 UTC

We would like to have possibility to split AVC audit messages from other logs (i.e. store AVC messages apart from EXEC logs)

Due to lack of the rsyslog feature (https://bugzilla.redhat.com/1860303) and the fact that it won't be implemented on a kernel level (https://bugzilla.redhat.com/1859965), the last hope is to get it implemented on userspace audit level.

The idea is to have possibility to filter specific audit messages (i.e. via existing syslog plugin or other) according to their types, so the following audit message routing example would be possible:
1) type=CWD    -> syslog [facility0]
2) type=EXECVE -> syslog [facility1]