--- .../audit_rules_networkconfig_modification.xml | 2 +- RHEL6/input/system/auditing.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/RHEL6/input/checks/audit_rules_networkconfig_modification.xml b/RHEL6/input/checks/audit_rules_networkconfig_modification.xml index be2c90f..e2fee0e 100644 --- a/RHEL6/input/checks/audit_rules_networkconfig_modification.xml +++ b/RHEL6/input/checks/audit_rules_networkconfig_modification.xml @@ -33,7 +33,7 @@ </ind:textfilecontent54_test> <ind:textfilecontent54_object id="object_audit_rules_networkconfig_modification_syscall" version="1"> <ind:filepath>/etc/audit/audit.rules</ind:filepath> - <ind:pattern operation="pattern match">^\-a\s+exit,always\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+sethostname\s+\-S\s+setdomainname\s+\-k\s+[-\w]+\s*$</ind:pattern> + <ind:pattern operation="pattern match">^\-a\s+(always,exit|exit,always)\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+sethostname\s+\-S\s+setdomainname\s+\-k\s+[-\w]+\s*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> <ind:textfilecontent54_object id="object_audit_rules_networkconfig_modification_etc_issue" version="1"> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index b1768ee..4597b6f 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -662,7 +662,7 @@ legitimacy.</rationale> <description>Add the following to <tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as appropriate for your system: <pre># audit_network_modifications --a exit,always -F arch=ARCH -S sethostname -S setdomainname -k audit_network_modifications +-a always,exit -F arch=ARCH -S sethostname -S setdomainname -k audit_network_modifications -w /etc/issue -p wa -k audit_network_modifications -w /etc/issue.net -p wa -k audit_network_modifications -w /etc/hosts -p wa -k audit_network_modifications-- 1.7.1