Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
.../auditd_data_retention_action_mail_acct.xml | 36 ++++++++++++++++++++
.../auditd_data_retention_admin_space_left.xml | 30 ----------------
...ditd_data_retention_admin_space_left_action.xml | 36 ++++++++++++++++++++
.../checks/auditd_data_retention_mail_acct.xml | 30 ----------------
.../input/checks/auditd_data_retention_max_log.xml | 30 ----------------
.../checks/auditd_data_retention_max_log_file.xml | 28 +++++++++------
.../auditd_data_retention_max_log_file_action.xml | 36 ++++++++++++++++++++
.../checks/auditd_data_retention_num_logs.xml | 36 ++++++++++++++++++++
.../checks/auditd_data_retention_space_left.xml | 30 ----------------
.../auditd_data_retention_space_left_action.xml | 36 ++++++++++++++++++++
10 files changed, 197 insertions(+), 131 deletions(-)
create mode 100644 rhel6/src/input/checks/auditd_data_retention_action_mail_acct.xml
delete mode 100644 rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml
create mode 100644
rhel6/src/input/checks/auditd_data_retention_admin_space_left_action.xml
delete mode 100644 rhel6/src/input/checks/auditd_data_retention_mail_acct.xml
delete mode 100644 rhel6/src/input/checks/auditd_data_retention_max_log.xml
create mode 100644 rhel6/src/input/checks/auditd_data_retention_max_log_file_action.xml
create mode 100644 rhel6/src/input/checks/auditd_data_retention_num_logs.xml
delete mode 100644 rhel6/src/input/checks/auditd_data_retention_space_left.xml
create mode 100644 rhel6/src/input/checks/auditd_data_retention_space_left_action.xml
diff --git a/rhel6/src/input/checks/auditd_data_retention_action_mail_acct.xml
b/rhel6/src/input/checks/auditd_data_retention_action_mail_acct.xml
new file mode 100644
index 0000000..3782c06
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_action_mail_acct.xml
@@ -0,0 +1,36 @@
+<def-group>
+ <definition class="compliance"
id="auditd_data_retention_action_mail_acct" version="1">
+ <metadata>
+ <title>Auditd Email Account to Notify Upon Action</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="TODO" source="CCE" />
+ <description>action_mail_acct setting in /etc/audit/auditd.conf is set to a
certain account</description>
+ </metadata>
+
+ <criteria>
+ <criterion comment="action_mail_acct setting in auditd.conf"
test_ref="test_auditd_data_retention_action_mail_acct" />
+ </criteria>
+
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="email account for
actions" id="test_auditd_data_retention_action_mail_acct"
version="1">
+ <ind:object object_ref="object_auditd_data_retention_action_mail_acct"
/>
+ <ind:state state_ref="state_auditd_data_retention_action_mail_acct"
/>
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object
id="object_auditd_data_retention_action_mail_acct" version="1">
+ <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+ <ind:pattern operation="pattern
match">^action_mail_acct\s*=\s*(\S+)\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state
id="state_auditd_data_retention_action_mail_acct" version="1">
+ <ind:subexpression operation="equals"
var_ref="var_auditd_action_mail_acct" />
+ </ind:textfilecontent54_state>
+
+ <external_variable comment="audit action_mail_acct setting"
datatype="string" id="var_auditd_action_mail_acct"
version="1" />
+
+
+</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml
b/rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml
deleted file mode 100644
index 5c708b8..0000000
--- a/rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<def-group>
- <definition class="compliance"
id="auditd_data_retention_admin_space_left" version="1">
- <metadata>
- <title>Auditd Admin Space Left Action</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <reference ref_id="TODO" source="CCE" />
- <description>max_log_file_action line of auditd.conf is set to act
appropriately when auditing disk space runs low.</description>
- </metadata>
-
- <criteria>
-
- <criterion comment="space left line halt"
test_ref="test_auditd_data_retention_admin_space_left_action" />
-
- </criteria>
-
- </definition>
-
- <ind:textfilecontent54_test check="all" comment="space left line
halt" id="test_auditd_data_retention_admin_space_left_action"
version="1">
- <ind:object
object_ref="object_auditd_data_retention_admin_space_left_action" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object
id="object_auditd_data_retention_admin_space_left_action"
version="1">
- <ind:path>/etc/audit</ind:path>
- <ind:filename>auditd.conf</ind:filename>
- <ind:pattern operation="pattern
match">^admin\_space\_left\_action[\s]+\=[\s]+halt\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_admin_space_left_action.xml
b/rhel6/src/input/checks/auditd_data_retention_admin_space_left_action.xml
new file mode 100644
index 0000000..db5f2b6
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_admin_space_left_action.xml
@@ -0,0 +1,36 @@
+<def-group>
+ <definition class="compliance"
id="auditd_data_retention_admin_space_left_action" version="1">
+ <metadata>
+ <title>Auditd Action to Take When Disk is Low on Space</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="TODO" source="CCE" />
+ <description>admin_space_left_action setting in /etc/audit/auditd.conf is set
to a certain action</description>
+ </metadata>
+
+ <criteria>
+ <criterion comment="admin_space_left_action setting in auditd.conf"
test_ref="test_auditd_data_retention_admin_space_left_action" />
+ </criteria>
+
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="space left
action" id="test_auditd_data_retention_admin_space_left_action"
version="1">
+ <ind:object
object_ref="object_auditd_data_retention_admin_space_left_action" />
+ <ind:state
state_ref="state_auditd_data_retention_admin_space_left_action" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object
id="object_auditd_data_retention_admin_space_left_action"
version="1">
+ <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+ <ind:pattern operation="pattern
match">^admin_space_left_action\s*=\s*(\S+)\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state
id="state_auditd_data_retention_admin_space_left_action"
version="1">
+ <ind:subexpression operation="case insensitive equals"
var_ref="var_auditd_admin_space_left_action" />
+ </ind:textfilecontent54_state>
+
+ <external_variable comment="audit admin_space_left_action setting"
datatype="string" id="var_auditd_admin_space_left_action"
version="1" />
+
+
+</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_mail_acct.xml
b/rhel6/src/input/checks/auditd_data_retention_mail_acct.xml
deleted file mode 100644
index 172266b..0000000
--- a/rhel6/src/input/checks/auditd_data_retention_mail_acct.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<def-group>
- <definition class="compliance"
id="auditd_data_retention_mail_acct" version="1">
- <metadata>
- <title>Auditd Mail Acct Action</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <reference ref_id="TODO" source="CCE" />
- <description>action_mail_acct line of auditd.conf is set to act appropriately
when auditing disk space runs low.</description>
- </metadata>
-
- <criteria>
-
- <criterion comment="mail acct action root"
test_ref="test_auditd_data_retention_mail_acct_action" />
-
- </criteria>
-
- </definition>
-
- <ind:textfilecontent54_test check="all" comment="mail acct action
root" id="test_auditd_data_retention_mail_acct_action"
version="1">
- <ind:object object_ref="object_auditd_data_retention_mail_acct_action"
/>
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object
id="object_auditd_data_retention_mail_acct_action" version="1">
- <ind:path> /etc/audit</ind:path>
- <ind:filename>auditd.conf</ind:filename>
- <ind:pattern operation="pattern
match">^action\_mail\_acct[\s]+\=[\s]+root\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_max_log.xml
b/rhel6/src/input/checks/auditd_data_retention_max_log.xml
deleted file mode 100644
index 90d3b6a..0000000
--- a/rhel6/src/input/checks/auditd_data_retention_max_log.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<def-group>
- <definition class="compliance"
id="auditd_data_retention_max_log" version="1">
- <metadata>
- <title>Auditd Max Log File Size Set</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <reference ref_id="TODO" source="CCE" />
- <description>max_log_file line is set in auditd.conf.</description>
- </metadata>
-
- <criteria>
-
- <criterion comment="max log size"
test_ref="test_auditd_data_retention_max_log_size" />
-
- </criteria>
-
- </definition>
-
- <ind:textfilecontent54_test check="all" comment="max log size"
id="test_auditd_data_retention_max_log_size" version="1">
- <ind:object object_ref="object_auditd_data_retention_max_log_size"
/>
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object
id="object_auditd_data_retention_max_log_size" version="1">
- <ind:path>/etc/audit</ind:path>
- <ind:filename>auditd.conf</ind:filename>
- <ind:pattern operation="pattern
match">^max\_log\_file[\s]+[\d]\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml
b/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml
index f05d59f..a49d7ad 100644
--- a/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml
+++ b/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml
@@ -1,30 +1,36 @@
<def-group>
<definition class="compliance"
id="auditd_data_retention_max_log_file" version="1">
<metadata>
- <title>Auditd Max Log File Action Set</title>
+ <title>Auditd Maximum Log File Size</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<reference ref_id="TODO" source="CCE" />
- <description>max_log_file_action is set to keep logs.</description>
+ <description>max_log_file setting in /etc/audit/auditd.conf is set to at
least a certain value</description>
</metadata>
<criteria>
-
- <criterion comment="max log file action"
test_ref="test_auditd_data_retention_max_log_file_size" />
-
+ <criterion comment="max_log_file setting in auditd.conf"
test_ref="test_auditd_data_retention_max_log_file" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all" comment="max log file
action" id="test_auditd_data_retention_max_log_file_size"
version="1">
- <ind:object object_ref="object_auditd_data_retention_max_log_file_size"
/>
+ <ind:textfilecontent54_test check="all" comment="max log file
size" id="test_auditd_data_retention_max_log_file"
version="1">
+ <ind:object object_ref="object_auditd_data_retention_max_log_file"
/>
+ <ind:state state_ref="state_auditd_data_retention_max_log_file" />
</ind:textfilecontent54_test>
- <ind:textfilecontent54_object
id="object_auditd_data_retention_max_log_file_size" version="1">
- <ind:path>/etc/audit</ind:path>
- <ind:filename>auditd.conf</ind:filename>
- <ind:pattern operation="pattern
match">^max\_log\_file\_action[\s]+\=[\s]+keep\_logs\s*$</ind:pattern>
+
+ <ind:textfilecontent54_object
id="object_auditd_data_retention_max_log_file" version="1">
+ <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+ <ind:pattern operation="pattern
match">^max_log_file\s*=\s*(\d+)\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
+ <ind:textfilecontent54_state id="state_auditd_data_retention_max_log_file"
version="1">
+ <ind:subexpression operation="greater than or equal"
var_ref="var_auditd_max_log_file" />
+ </ind:textfilecontent54_state>
+
+ <external_variable comment="audit max_log_file settting"
datatype="int" id="var_auditd_max_log_file" version="1"
/>
+
+
</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_max_log_file_action.xml
b/rhel6/src/input/checks/auditd_data_retention_max_log_file_action.xml
new file mode 100644
index 0000000..21d13c7
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_max_log_file_action.xml
@@ -0,0 +1,36 @@
+<def-group>
+ <definition class="compliance"
id="auditd_data_retention_max_log_file_action" version="1">
+ <metadata>
+ <title>Auditd Action to Take When Maximum Log Size Reached</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="TODO" source="CCE" />
+ <description>max_log_file_action setting in /etc/audit/auditd.conf is set to
a certain action</description>
+ </metadata>
+
+ <criteria>
+ <criterion comment="max_log_file_action setting in auditd.conf"
test_ref="test_auditd_data_retention_max_log_file_action" />
+ </criteria>
+
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="admin space left
action " id="test_auditd_data_retention_max_log_file_action"
version="1">
+ <ind:object
object_ref="object_auditd_data_retention_max_log_file_action" />
+ <ind:state state_ref="state_auditd_data_retention_max_log_file_action"
/>
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object
id="object_auditd_data_retention_max_log_file_action" version="1">
+ <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+ <ind:pattern operation="pattern
match">^max_log_file_action\s*=\s*(\S+)\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state
id="state_auditd_data_retention_max_log_file_action" version="1">
+ <ind:subexpression operation="case insensitive equals"
var_ref="var_auditd_max_log_file_action" />
+ </ind:textfilecontent54_state>
+
+ <external_variable comment="audit max_log_file_action setting"
datatype="string" id="var_auditd_max_log_file_action"
version="1" />
+
+
+</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_num_logs.xml
b/rhel6/src/input/checks/auditd_data_retention_num_logs.xml
new file mode 100644
index 0000000..9021d80
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_num_logs.xml
@@ -0,0 +1,36 @@
+<def-group>
+ <definition class="compliance"
id="auditd_data_retention_num_logs" version="1">
+ <metadata>
+ <title>Auditd Maximum Number of Logs to Retain</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="TODO" source="CCE" />
+ <description>num_logs setting in /etc/audit/auditd.conf is set to at least a
certain value</description>
+ </metadata>
+
+ <criteria>
+ <criterion comment="num_logs setting in auditd.conf"
test_ref="test_auditd_data_retention_num_logs" />
+ </criteria>
+
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="admin space left
action " id="test_auditd_data_retention_num_logs"
version="1">
+ <ind:object object_ref="object_auditd_data_retention_num_logs" />
+ <ind:state state_ref="state_auditd_data_retention_num_logs" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_auditd_data_retention_num_logs"
version="1">
+ <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+ <ind:pattern operation="pattern
match">^num_logs\s*=\s*(\d+)\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state id="state_auditd_data_retention_num_logs"
version="1">
+ <ind:subexpression operation="greater than or equal"
var_ref="var_auditd_num_logs" />
+ </ind:textfilecontent54_state>
+
+ <external_variable comment="audit num_logs settting"
datatype="int" id="var_auditd_num_logs" version="1" />
+
+
+</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_space_left.xml
b/rhel6/src/input/checks/auditd_data_retention_space_left.xml
deleted file mode 100644
index 29f97eb..0000000
--- a/rhel6/src/input/checks/auditd_data_retention_space_left.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<def-group>
- <definition class="compliance"
id="auditd_data_retention_space_left" version="1">
- <metadata>
- <title>Auditd Space Left Action</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <reference ref_id="TODO" source="CCE" />
- <description>space_left_action line of auditd.conf is set to act
appropriately when auditing disk space runs low.</description>
- </metadata>
-
- <criteria>
-
- <criterion comment="space left action email"
test_ref="test_auditd_data_retention_space_left_action" />
-
- </criteria>
-
- </definition>
-
- <ind:textfilecontent54_test check="all" comment="space left action
email" id="test_auditd_data_retention_space_left_action"
version="1">
- <ind:object object_ref="object_auditd_data_retention_space_left_action"
/>
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object
id="object_auditd_data_retention_space_left_action" version="1">
- <ind:path> /etc/audit</ind:path>
- <ind:filename>auditd.conf</ind:filename>
- <ind:pattern operation="pattern
match">^space\_left\_action[\s]+\=[\s]+email\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_space_left_action.xml
b/rhel6/src/input/checks/auditd_data_retention_space_left_action.xml
new file mode 100644
index 0000000..ad5c8fd
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_space_left_action.xml
@@ -0,0 +1,36 @@
+<def-group>
+ <definition class="compliance"
id="auditd_data_retention_space_left_action" version="1">
+ <metadata>
+ <title>Auditd Action to Take When Disk Starting to Run Low on
Space</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="TODO" source="CCE" />
+ <description>space_left_action setting in /etc/audit/auditd.conf is set to a
certain action</description>
+ </metadata>
+
+ <criteria>
+ <criterion comment="space_left_action setting in auditd.conf"
test_ref="test_auditd_data_retention_space_left_action" />
+ </criteria>
+
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="space left
action" id="test_auditd_data_retention_space_left_action"
version="1">
+ <ind:object object_ref="object_auditd_data_retention_space_left_action"
/>
+ <ind:state state_ref="state_auditd_data_retention_space_left_action"
/>
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object
id="object_auditd_data_retention_space_left_action" version="1">
+ <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+ <ind:pattern operation="pattern
match">^space_left_action\s*=\s*(\S+)\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state
id="state_auditd_data_retention_space_left_action" version="1">
+ <ind:subexpression operation="case insensitive equals"
var_ref="var_auditd_space_left_action" />
+ </ind:textfilecontent54_state>
+
+ <external_variable comment="audit space_left_action setting"
datatype="string" id="var_auditd_space_left_action"
version="1" />
+
+
+</def-group>
--
1.7.1