From shawn at redhat.com Thu Aug 20 11:32:49 2015 Content-Type: multipart/mixed; boundary="===============8229290455954454488==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 07/10] Audit rule requires arch type. Date: Fri, 02 Nov 2012 22:33:42 -0400 Message-ID: <50948286.60803@redhat.com> In-Reply-To: 1351830337-1516-7-git-send-email-mnewman@redhat.com --===============8229290455954454488== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 11/2/12 12:25 AM, Michele Newman wrote: > --- > RHEL6/input/system/auditing.xml | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditin= g.xml > index e689509..c347936 100644 > --- a/RHEL6/input/system/auditing.xml > +++ b/RHEL6/input/system/auditing.xml > @@ -1261,11 +1261,11 @@ of what was executed on the system as well as for= accountability purposes. > Ensure <tt>auditd</tt> Collects Information on Kernel Module Loa= ding and Unloading > Add the following to /etc/audit/audit.rules in or= der > -to capture kernel module loading and unloading events: > +to capture kernel module loading and unloading events, setting ARCH to e= ither b32 or b64 as appropriate for your system: >
-w /sbin/insmod -p x -k modules
>   -w /sbin/rmmod -p x -k modules
>   -w /sbin/modprobe -p x -k modules
> --a always,exit -S init_module -S delete_module -k modules
> +-a always,exit -F arch=3DARCH -S init_module -S delete_module -k = modules >
> > > -- 1.8.0 Good catch. Ack. --===============8229290455954454488==--