[PATCH 6/9] Mapped CCI-000172 to both enable_auditd_service and auditd_configure_rules
Shawn Wells
shawn at redhat.com
Tue Apr 24 17:41:23 UTC 2012
This CCI requires that audit rules both be defined and actually audited, which is met by enforcing both enable_auditd_service auditd_configure_rules
---
rhel6/src/input/system/auditing.xml | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 05e7a57..7cc41b2 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -78,6 +78,7 @@ default):
<oval id="service_auditd_enabled" />
<ref nist="CM-6, CM-7" />
<ident cci="CCI-000169" />
+<ident cci="CCI-000172" />
</Rule>
<Rule id="enable_auditd_bootloader">
@@ -138,6 +139,7 @@ editing as needed, activate the new rules:
<pre># service auditd restart</pre>
</description>
<ident cci="CCI-000171" />
+<ident cci="CCI-000172" />
<Rule id="audit_time_rules">
<title>Records Events that Modify Date and Time Information</title>
--
1.7.1
--cWoXeonUoKmBZSoM--
More information about the scap-security-guide
mailing list