[PATCH 06/24] - Updated -k to audit_mac_changes - Included 800-53 subsection

Shawn Wells shawn at redhat.com
Wed Feb 22 03:09:20 UTC 2012


---
 rhel6/src/input/system/auditing.xml |    9 ++++-----
 1 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 045cf45..93b95dc 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -210,19 +210,18 @@ administrator action. Any change to network parameters should be audited.</ratio
 
 
 <Rule id="audit_mac_changes">
-<title>Record Events that Modify the System’s Mandatory Access
-Controls</title>
+<title>Record Events that Modify the System’s Mandatory Access Controls</title>
 <description>Add the following to <tt>/etc/audit/audit.rules</tt>:
 <br />
-<pre>
--w /etc/selinux/ -p wa -k MAC-policy</pre>
+<pre># audit_mac_changes
+-w /etc/selinux/ -p wa -k audit_mac_changes</pre>
 </description>
 <!-- TODO add info for selinux system calls which load new policy? -->
 <rationale>The system's mandatory access policy (SELinux) should not be arbitrarily changed by
 anything other than administrator action. All changes to MAC policy should be audited.</rationale>
 <ident cce="14821-3" />
 <oval id="audit_rules_mac_modification" />
-<ref nist="AU-2" />
+<ref nist="AU-2(a)" />
 </Rule>
 
 
-- 
1.7.1


--x+6KMIRAuhnl3hBn--


More information about the scap-security-guide mailing list