[PATCH 15/21] Mapped CCI-001487 to service_auditd_enable and auditd_configure_rules
Shawn Wells
shawn at redhat.com
Tue Apr 24 19:38:43 UTC 2012
This CCI requires the system to "must produce audit records...." which is met by both turning on auditd and configuring it
---
rhel6/src/input/system/auditing.xml | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 1c6db7a..8f33e56 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -82,6 +82,7 @@ default):
<ident cci="CCI-000174" />
<ident cci="CCI-001353" />
<ident cci="CCI-001462" />
+<ident cci="CCI-001487" />
</Rule>
<Rule id="enable_auditd_bootloader">
@@ -145,6 +146,7 @@ editing as needed, activate the new rules:
<ident cci="CCI-000171" />
<ident cci="CCI-000172" />
<ident cci="CCI-001571" />
+<ident cci="CCI-001487" />
<Rule id="audit_time_rules">
<title>Records Events that Modify Date and Time Information</title>
--
1.7.1
--ZGiS0Q5IWpPtfppv--
More information about the scap-security-guide
mailing list