Ah, yes, after thinking about it for a bit, this makes sense.
I had some concerns about going overboard on granularity, but as you can
see in the RHEL 5 manual STIG
...that one of our future project consumers also felt that this was the
right level of granularity.
Ack / Thanks!
On 06/18/2012 10:28 AM, Kevin Spargur wrote:
Broke apart the auditd rule for time changes into individual
to better support being able to define these rules in a variety of ways.
Also added a couple generic architecture tests. Note that the architecture
tests have a class of miscellaneous rather than inventory. Per OVAL
specification Version 5.10.1 Revision 1 an oval class of inventory "describes
OVAL Definitions that check to see if a piece of software is installed on a
Signed-off-by: Kevin Spargur <kspargur(a)redhat.com>
Kevin Spargur (1):
Broke apart auditd rules/prose for time changes, broke out
.../src/input/checks/audit_rules_time_adjtimex.xml | 57 +++++++++
.../checks/audit_rules_time_clock_settime.xml | 57 +++++++++
.../input/checks/audit_rules_time_settimeofday.xml | 57 +++++++++
rhel6/src/input/checks/audit_rules_time_stime.xml | 41 +++++++
.../checks/audit_rules_time_watch_localtime.xml | 33 +++++
.../input/checks/system_info_architecture_x86.xml | 30 +++++
.../checks/system_info_architecture_x86_64.xml | 30 +++++
rhel6/src/input/profiles/common.xml | 8 +-
rhel6/src/input/system/auditing.xml | 126 ++++++++++++++++++--
9 files changed, 427 insertions(+), 12 deletions(-)
create mode 100644 rhel6/src/input/checks/audit_rules_time_adjtimex.xml
create mode 100644 rhel6/src/input/checks/audit_rules_time_clock_settime.xml
create mode 100644 rhel6/src/input/checks/audit_rules_time_settimeofday.xml
create mode 100644 rhel6/src/input/checks/audit_rules_time_stime.xml
create mode 100644 rhel6/src/input/checks/audit_rules_time_watch_localtime.xml
create mode 100644 rhel6/src/input/checks/system_info_architecture_x86.xml
create mode 100644 rhel6/src/input/checks/system_info_architecture_x86_64.xml