[PATCH 07/24] - Updated audit_dac_actions, changed -k to audit_dac_actions - Formating fixes
Shawn Wells
shawn at redhat.com
Wed Feb 22 03:15:02 UTC 2012
---
rhel6/src/input/system/auditing.xml | 18 +++++++-----------
1 files changed, 7 insertions(+), 11 deletions(-)
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 93b95dc..2e943d8 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -226,21 +226,17 @@ anything other than administrator action. All changes to MAC policy should be au
<Rule id="audit_dac_actions">
-<title>Ensure <tt>auditd</tt> Collects Discretionary Access Control
-Permission Modification Events</title>
-<description>At a minimum the audit system should collect file
-permission changes for all users and root. Add the following to
-<tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as
-appropriate for your system:
+<title>Ensure <tt>auditd</tt> Collects Discretionary Access Control Policy Modification Events</title>
+<description>At a minimum the audit system should collect file permission changes for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as appropriate for your system:
<br />
-<pre>
+<pre># audit_dac_actions
-a always,exit -F arch=ARCH -S chmod -S fchmod -S fchmodat \
- -F auid>=500 -F auid!=4294967295 -k perm_mod
+ -F auid>=500 -F auid!=4294967295 -k audit_dac_actions
-a always,exit -F arch=ARCH -S chown -S fchown -S fchownat \
- -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod
+ -S lchown -F auid>=500 -F auid!=4294967295 -k audit_dac_actions
-a always,exit -F arch=ARCH -S setxattr -S lsetxattr \
-S fsetxattr -S removexattr -S lremovexattr -S fremovexattr \
- -F auid>=500 -F auid!=4294967295 -k perm_mod</pre>
+ -F auid>=500 -F auid!=4294967295 -k audit_dac_actions</pre>
</description>
<rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
@@ -248,7 +244,7 @@ can facilitate the identification of patterns of abuse amoung both authorized an
unauthorized users.</rationale>
<ident cce="14058-2" />
<oval id="audit_rules_dac_modification" />
-<ref nist="AU-2" />
+<ref nist="AU-2(a)" />
</Rule>
<Rule id="audit_file_access">
--
1.7.1
--liOOAslEiF7prFVr--
More information about the scap-security-guide
mailing list