[PATCH 10/11] - Updated key (-k audit_kernel_module_loading) - Minor content/syntax adjustments
Shawn Wells
shawn at redhat.com
Wed Feb 22 04:03:23 UTC 2012
---
rhel6/src/input/system/auditing.xml | 17 +++++++----------
1 files changed, 7 insertions(+), 10 deletions(-)
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index a950096..71d70b7 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -311,15 +311,13 @@ This script will give you several lines of output, and the output below is from
<br />
Take the output of the script and place it into <tt>/etc/audit/audit.rules</tt>.
</description>
-
<ident cce="14296-8" />
<oval id="audit_rules_privileged_commands" />
<ref nist="AU-2" />
</Rule>
<Rule id="audit_media_exports">
-<title>Ensure <tt>auditd</tt> Collects Information on Exporting to Media
-(successful)</title>
+<title>Ensure <tt>auditd</tt> Collects Information on Exporting to Media (successful)</title>
<description>At a minimum the audit system should collect media
exportation events for all users and root. Add the following to
<tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as
@@ -374,16 +372,15 @@ of what was executed on the system as well as for accountability purposes.</rati
</Rule>
<Rule id="audit_kernel_module_loading">
-<title>Ensure <tt>auditd</tt> Collects Information on Kernel Module Loading
-and Unloading</title>
+<title>Ensure <tt>auditd</tt> Collects Information on Kernel Module Loading and Unloading</title>
<description>Add the following to <tt>/etc/audit/audit.rules</tt> in order
to capture kernel module loading and unloading events:
<br />
-<pre>
--w /sbin/insmod -p x -k modules
--w /sbin/rmmod -p x -k modules
--w /sbin/modprobe -p x -k modules
--a always,exit -S init_module -S delete_module -k modules</pre>
+<pre># audit_kernel_module_loading
+-w /sbin/insmod -p x -k audit_kernel_module_loading
+-w /sbin/rmmod -p x -k audit_kernel_module_loading
+-w /sbin/modprobe -p x -k audit_kernel_module_loading
+-a always,exit -S init_module -S delete_module -k audit_kernel_module_loading</pre>
</description>
<rationale>The addition/removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
--
1.7.1
--------------000900060402000407000504--
More information about the scap-security-guide
mailing list