>From 78fb8befe818ab9f5dd04df85fff49015b138f66 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Tue, 21 Feb 2012 22:09:20 -0500 Subject: [PATCH 06/11] - Updated -k to audit_mac_changes - Included 800-53 subsection --- rhel6/src/input/system/auditing.xml | 9 ++++----- 1 files changed, 4 insertions(+), 5 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 045cf45..93b95dc 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -210,19 +210,18 @@ administrator action. Any change to network parameters should be audited. -Record Events that Modify the System’s Mandatory Access -Controls +Record Events that Modify the System’s Mandatory Access Controls Add the following to /etc/audit/audit.rules:
-
--w /etc/selinux/ -p wa -k MAC-policy
+
# audit_mac_changes
+-w /etc/selinux/ -p wa -k audit_mac_changes
The system's mandatory access policy (SELinux) should not be arbitrarily changed by anything other than administrator action. All changes to MAC policy should be audited. - + -- 1.7.1