[rpms/fedora-release] f45: Presets: enable auditd-rules.service

[rpms/fedora-release] f45: Presets: enable auditd-rules.service

[Stephen Gallagher]

            A new commit has been pushed.

            Repo   : rpms/fedora-release
            Branch : f45
            Commit : 37fd69c9e1278228e18ab88b2482189c05a4d39d
            Author : Stephen Gallagher <sgallagh@redhat.com>
            Date   : 2024-01-15T15:36:31-05:00
            Stats  : +3/-0 in 1 file(s)
            URL    : https://src.fedoraproject.org/rpms/fedora-release/c/37fd69c9e1278228e18ab88b2482189c05a4d39d?branch=f45

            Log:
            Presets: enable auditd-rules.service

The audit daemon loaded the rules in the past. But eventaully it was noticed
that there was a problem where system events that were of interest occurred
before auditd could start. Splitting them allows the rules to load sooner so
the events are waiting when auditd registers with the kernel.

The secondary effect of this split is that some people may be satisfied with
audit events in journald. This would let them have auditing without having to
install auditd and it man pages and utilities. It certainly won't have search
and report capabilities. But they may be offloading events to a central SIEM
and don't care.

https://bugzilla.redhat.com/show_bug.cgi?id=2258520

Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>

---
diff --git a/90-default.preset b/90-default.preset
index 2a7e6d9..46cbccc 100644
--- a/90-default.preset
+++ b/90-default.preset
@@ -40,6 +40,9 @@ enable ModemManager.service
 # Approved by FESCo - https://fedorahosted.org/fesco/ticket/1311
 enable auditd.service
 
+# https://bugzilla.redhat.com/show_bug.cgi?id=2258520
+enable audit-rules.service
+
 # Locally-running service
 enable restorecond.service