>From 774aced68a92027d20a5157cb80bae748ba433a5 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sun, 15 Sep 2013 17:12:17 -0400 Subject: [PATCH 15/22] OVAL signoff + remediation: auditd_data_retention_admin_space_left_action - OVAL signoff - Updated XCCDF/OVAL namings - Remediation script TESTING; [root@SSG-RHEL6 checks]# var_auditd_admin_space_left_action=SINGLE ; export var_auditd_admin_space_left_action [root@SSG-RHEL6 checks]# ./testcheck.py auditd_data_retention_admin_space_left_action.xml external_variable with id : var_auditd_admin_space_left_action Evaluating with OVAL tempfile : /tmp/auditd_data_retention_admin_space_left_actionlbbPyb.xml Writing results to : /tmp/auditd_data_retention_admin_space_left_actionlbbPyb.xml-results Definition oval:scap-security-guide.testing:def:166: true Evaluation done. [root@SSG-RHEL6 checks]# sed -i "s/admin_space_left_action.*/admin_space_left_action = BROKE/g" /etc/audit/auditd.conf [root@SSG-RHEL6 checks]# ./testcheck.py auditd_data_retention_admin_space_left_action.xml external_variable with id : var_auditd_admin_space_left_action Evaluating with OVAL tempfile : /tmp/auditd_data_retention_admin_space_left_actionJNf4lp.xml Writing results to : /tmp/auditd_data_retention_admin_space_left_actionJNf4lp.xml-results Definition oval:scap-security-guide.testing:def:166: false Evaluation done. --- ...ditd_data_retention_admin_space_left_action.xml | 1 + ...uditd_data_retention_admin_space_left_action.sh | 8 ++++++++ RHEL6/input/profiles/common.xml | 2 +- RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 2 +- RHEL6/input/profiles/nist-CL-IL-AL.xml | 2 +- RHEL6/input/profiles/test.xml | 2 +- RHEL6/input/system/auditing.xml | 17 +++-------------- 7 files changed, 16 insertions(+), 18 deletions(-) create mode 100644 RHEL6/input/fixes/bash/auditd_data_retention_admin_space_left_action.sh diff --git a/RHEL6/input/checks/auditd_data_retention_admin_space_left_action.xml b/RHEL6/input/checks/auditd_data_retention_admin_space_left_action.xml index e6683a6..2829104 100644 --- a/RHEL6/input/checks/auditd_data_retention_admin_space_left_action.xml +++ b/RHEL6/input/checks/auditd_data_retention_admin_space_left_action.xml @@ -6,6 +6,7 @@ Red Hat Enterprise Linux 6 admin_space_left_action setting in /etc/audit/auditd.conf is set to a certain action + diff --git a/RHEL6/input/fixes/bash/auditd_data_retention_admin_space_left_action.sh b/RHEL6/input/fixes/bash/auditd_data_retention_admin_space_left_action.sh new file mode 100644 index 0000000..68d684f --- /dev/null +++ b/RHEL6/input/fixes/bash/auditd_data_retention_admin_space_left_action.sh @@ -0,0 +1,8 @@ +source ./templates/support.sh +populate var_auditd_admin_space_left_action + +grep -q ^admin_space_left_action /etc/audit/auditd.conf && \ + sed -i "s/admin_space_left_action.*/admin_space_left_action = $var_auditd_space_left_action/g" /etc/audit/auditd.conf +if ! [ $? -eq 0 ]; then + echo "admin_space_left_action = $var_auditd_space_left_action" >> /etc/audit/auditd.conf +fi diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml index ab099be..dc6cd10 100644 --- a/RHEL6/input/profiles/common.xml +++ b/RHEL6/input/profiles/common.xml @@ -112,7 +112,7 @@ + diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml index 649a7c2..d50a06d 100644 --- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml +++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml @@ -195,7 +195,7 @@ - diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml index f28611d..a85fc15 100644 --- a/RHEL6/input/profiles/nist-CL-IL-AL.xml +++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml @@ -268,7 +268,7 @@ assurance." + -