[PATCH 07/24] - Updated audit_dac_actions, changed -k to audit_dac_actions - Formating fixes

Shawn Wells shawn at redhat.com
Wed Feb 22 03:15:02 UTC 2012


---
 rhel6/src/input/system/auditing.xml |   18 +++++++-----------
 1 files changed, 7 insertions(+), 11 deletions(-)

diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 93b95dc..2e943d8 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -226,21 +226,17 @@ anything other than administrator action. All changes to MAC policy should be au
 
 
 <Rule id="audit_dac_actions">
-<title>Ensure <tt>auditd</tt> Collects Discretionary Access Control
-Permission Modification Events</title>
-<description>At a minimum the audit system should collect file
-permission changes for all users and root. Add the following to
-<tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as
-appropriate for your system:
+<title>Ensure <tt>auditd</tt> Collects Discretionary Access Control Policy Modification Events</title>
+<description>At a minimum the audit system should collect file permission changes for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as appropriate for your system:
 <br />
-<pre>
+<pre># audit_dac_actions
 -a always,exit -F arch=ARCH -S chmod -S fchmod -S fchmodat \
-    -F auid&gt;=500 -F auid!=4294967295 -k perm_mod
+    -F auid&gt;=500 -F auid!=4294967295 -k audit_dac_actions
 -a always,exit -F arch=ARCH -S chown -S fchown -S fchownat \ 
-    -S lchown -F auid&gt;=500 -F auid!=4294967295 -k perm_mod
+    -S lchown -F auid&gt;=500 -F auid!=4294967295 -k audit_dac_actions
 -a always,exit -F arch=ARCH -S setxattr -S lsetxattr \
     -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr \
-    -F auid&gt;=500 -F auid!=4294967295 -k perm_mod</pre>
+    -F auid&gt;=500 -F auid!=4294967295 -k audit_dac_actions</pre>
 </description>
 <rationale>The changing of file permissions could indicate that a user is attempting to
 gain access to information that would otherwise be disallowed. Auditing DAC modifications
@@ -248,7 +244,7 @@ can facilitate the identification of patterns of abuse amoung both authorized an
 unauthorized users.</rationale>
 <ident cce="14058-2" />
 <oval id="audit_rules_dac_modification" />
-<ref nist="AU-2" />
+<ref nist="AU-2(a)" />
 </Rule>
 
 <Rule id="audit_file_access">
-- 
1.7.1


--liOOAslEiF7prFVr--


More information about the scap-security-guide mailing list