[PATCH 9/9] Mapped CCI-001462 to service_auditd_enabled

Shawn Wells shawn at redhat.com
Tue Apr 24 18:22:27 UTC 2012


CCI-001462 requires the "capability" to audit ALL user session information. In reality this is implimented by turning on key logging, however since we only have to provide the "capability" vs the "implimentation" we're calling this met by turning on audit.

It should be noted that this "capability" is actually met just by installing the auditd package, however that doesn't tie very nicely with anything in our existing content. At some point we should create a rule to check that audit is actually installed (not configured, but installed) and tie CCI-001462 to that rule.
---
 rhel6/src/input/system/auditing.xml |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index c9bccec..bb07c7b 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -81,6 +81,7 @@ default):
 <ident cci="CCI-000172" />
 <ident cci="CCI-000174" />
 <ident cci="CCI-001353" />
+<ident cci="CCI-001462" />
 </Rule>
 
 <Rule id="enable_auditd_bootloader">
-- 
1.7.1


--lrZ03NoBR/3+SXJZ--


More information about the scap-security-guide mailing list