[PATCH 1/9] Mapped CCI-000120 and CCI-000166 to auditing
Shawn Wells
shawn at redhat.com
Tue Apr 24 17:09:07 UTC 2012
These CCI's reflect the need for auditing, which doesn't map back to just one rule. Unsure how to handle such circumstances to I am mapping them back to the audit group.
---
rhel6/src/input/system/auditing.xml | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index e75754f..6967677 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -61,7 +61,8 @@ full. This minimizes the risk of audit data filling its partition
and impacting other services. However, it is possible to lose audit
data if the system is busy.
</description>
-
+<!-- <ident cci="CCI-000120" /> -->
+<!-- <ident cci="CCI-000166" /> -->
<Rule id="enable_auditd_service">
<title>Enable auditd Service</title>
@@ -74,6 +75,7 @@ default):
<ident cce="4292-9" />
<oval id="service_auditd_enabled" />
<ref nist="CM-6, CM-7" />
+<ident cci="CCI-000016, CCI-000166" />
</Rule>
<Rule id="enable_auditd_bootloader">
--
1.7.1
--huq684BweRXVnRxX--
More information about the scap-security-guide
mailing list