[PATCH 01/21] Mapped CCI-000120 and CCI-000166 to auditing

Shawn Wells shawn at redhat.com
Tue Apr 24 17:09:07 UTC 2012


These CCI's reflect the need for auditing, which doesn't map back to just one rule. Unsure how to handle such circumstances to I am mapping them back to the audit group.
---
 rhel6/src/input/system/auditing.xml |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index e75754f..6967677 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -61,7 +61,8 @@ full. This minimizes the risk of audit data filling its partition
 and impacting other services. However, it is possible to lose audit
 data if the system is busy.
 </description>
-
+<!-- <ident cci="CCI-000120" /> -->
+<!-- <ident cci="CCI-000166" /> -->
 
 <Rule id="enable_auditd_service">
 <title>Enable auditd Service</title>
@@ -74,6 +75,7 @@ default):
 <ident cce="4292-9" />
 <oval id="service_auditd_enabled" />
 <ref nist="CM-6, CM-7" />
+<ident cci="CCI-000016, CCI-000166" />
 </Rule>
 
 <Rule id="enable_auditd_bootloader">
-- 
1.7.1


--lrZ03NoBR/3+SXJZ--


More information about the scap-security-guide mailing list