From shawn at redhat.com Thu Aug 20 11:37:26 2015 Content-Type: multipart/mixed; boundary="===============2921381872768723656==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 11/21] Add applicability statement to audit_rules_time_stime/RHEL-06-000169 Date: Sun, 27 Jul 2014 23:37:18 -0400 Message-ID: <53D5C56E.6010004@redhat.com> In-Reply-To: 1406518028-3921-12-git-send-email-shawn@redhat.com --===============2921381872768723656== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 7/27/14, 11:26 PM, Shawn Wells wrote: > From: Leland Steinke > > - Update VRelease key > - Add OCIL applicability statement > > Signed-off-by: Leland Steinke > --- > RHEL/6/input/auxiliary/stig_overlay.xml | 2 +- > RHEL/6/input/system/auditing.xml | 1 + > 2 files changed, 2 insertions(+), 1 deletions(-) > > diff --git a/RHEL/6/input/auxiliary/stig_overlay.xml b/RHEL/6/input/auxil= iary/stig_overlay.xml > index bc540d6..86a5b5e 100644 > --- a/RHEL/6/input/auxiliary/stig_overlay.xml > +++ b/RHEL/6/input/auxiliary/stig_overlay.xml > @@ -469,7 +469,7 @@ > The audit system must be configured to audit all attempts to a= lter system time through settimeofday. > > > - > + > The audit system must be configured to audit all attempts to a= lter system time through stime. > > > diff --git a/RHEL/6/input/system/auditing.xml b/RHEL/6/input/system/audit= ing.xml > index 6c9f696..fbad0a9 100644 > --- a/RHEL/6/input/system/auditing.xml > +++ b/RHEL/6/input/system/auditing.xml > @@ -556,6 +556,7 @@ See an example of multiple combined syscalls: > -k audit_time_rules > > > +if the system is 64-bit only, this is not applicable.
> >
> Arbitrary changes to the system time can be used to obfuscate I see the case was fixed in patch 19. ack --===============2921381872768723656==--