[PATCH 6/9] Mapped CCI-000172 to both enable_auditd_service and auditd_configure_rules

Shawn Wells shawn at redhat.com
Tue Apr 24 17:41:23 UTC 2012


This CCI requires that audit rules both be defined and actually audited, which is met by enforcing both enable_auditd_service auditd_configure_rules
---
 rhel6/src/input/system/auditing.xml |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 05e7a57..7cc41b2 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -78,6 +78,7 @@ default):
 <oval id="service_auditd_enabled" />
 <ref nist="CM-6, CM-7" />
 <ident cci="CCI-000169" />
+<ident cci="CCI-000172" />
 </Rule>
 
 <Rule id="enable_auditd_bootloader">
@@ -138,6 +139,7 @@ editing as needed, activate the new rules:
 <pre># service auditd restart</pre>
 </description>
 <ident cci="CCI-000171" />
+<ident cci="CCI-000172" />
 
 <Rule id="audit_time_rules">
 <title>Records Events that Modify Date and Time Information</title>
-- 
1.7.1


--cWoXeonUoKmBZSoM--


More information about the scap-security-guide mailing list