[PATCH 06/11] - Updated -k to audit_mac_changes - Included 800-53 subsection
Shawn Wells
shawn at redhat.com
Wed Feb 22 03:09:20 UTC 2012
---
rhel6/src/input/system/auditing.xml | 9 ++++-----
1 files changed, 4 insertions(+), 5 deletions(-)
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 045cf45..93b95dc 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -210,19 +210,18 @@ administrator action. Any change to network parameters should be audited.</ratio
<Rule id="audit_mac_changes">
-<title>Record Events that Modify the System’s Mandatory Access
-Controls</title>
+<title>Record Events that Modify the System’s Mandatory Access Controls</title>
<description>Add the following to <tt>/etc/audit/audit.rules</tt>:
<br />
-<pre>
--w /etc/selinux/ -p wa -k MAC-policy</pre>
+<pre># audit_mac_changes
+-w /etc/selinux/ -p wa -k audit_mac_changes</pre>
</description>
<!-- TODO add info for selinux system calls which load new policy? -->
<rationale>The system's mandatory access policy (SELinux) should not be arbitrarily changed by
anything other than administrator action. All changes to MAC policy should be audited.</rationale>
<ident cce="14821-3" />
<oval id="audit_rules_mac_modification" />
-<ref nist="AU-2" />
+<ref nist="AU-2(a)" />
</Rule>
--
1.7.1
--------------070902090906040702030701--
More information about the scap-security-guide
mailing list