[PATCH 15/24] Fixed audit_dac_actions 32bit patch

Shawn Wells shawn at redhat.com
Sat Feb 25 20:03:39 UTC 2012


---
 rhel6/src/input/system/auditing.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index ad28607..223c145 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -269,7 +269,7 @@ anything other than administrator action. All changes to MAC policy should be au
     -F auid&gt;=500 -F auid!=4294967295 -k audit_dac_actions</pre>
 <br />
 Additionally, if you are on a 32-bit system add the following audit rule:
-<pre>-a always,exit -F arch=b32 -S truncate64 -S ftruncate64</pre>
+<pre>-a always,exit -F arch=b32 -S fchown32 -S chown32 -S lchown32</pre>
 </description>
 <rationale>The changing of file permissions could indicate that a user is attempting to
 gain access to information that would otherwise be disallowed. Auditing DAC modifications
-- 
1.7.1


--+QahgC5+KEYLbs62--


More information about the scap-security-guide mailing list