>From 1f78de8626f4c920e3ec713bd12b6dc68a0a87c5 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 25 Feb 2012 14:56:11 -0500 Subject: [PATCH 13/24] Created audit_auditd_modifications Section - Attempts to modify auditd configuration during runtime need to be audited per Common Criteria sections FAU_SEL.1 and FMT_MTD.1 --- rhel6/src/input/system/auditing.xml | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index a520e5a..fa63f1d 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -201,6 +201,22 @@ to capture events that modify account changes: + +Audit Attempts Modify <tt>auditd</tt> +Attempts to modify audit configuration which occur while the audit collection functions are operating should be monitored. +
+
# audit_auditd_modifications
+-w /etc/audit/ -p wa -k audit_auditd_modifications
+-w /etc/sysconfig/auditd -p wa -k audit_auditd_modifications
+-w /etc/libaudit.conf -p wa -k audit_auditd_modifications
+-w /etc/audisp/ -p wa -k audit_auditd_modifications
+
+Attempts to modify the auditd subsystem while the system is operational can indicate malicious intent. + + + +
+ Record Events that Modify the System’s Network Environment -- 1.7.1