[PATCH 17/24] Modified audit_network_modifications to watch /etc/sysconfig/network-scripts/ directory - Modified audit_network_modifications to watch /etc/sysconfig/network-scripts/ directory - Updated audit_rules_networkconfig_modification.xml for the check as well

Shawn Wells shawn at redhat.com
Sat Feb 25 20:24:46 UTC 2012


---
 .../audit_rules_networkconfig_modification.xml     |    6 ++++++
 rhel6/src/input/system/auditing.xml                |    1 +
 2 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/rhel6/src/input/checks/audit_rules_networkconfig_modification.xml b/rhel6/src/input/checks/audit_rules_networkconfig_modification.xml
index 1c6b6b2..dcdf3e6 100644
--- a/rhel6/src/input/checks/audit_rules_networkconfig_modification.xml
+++ b/rhel6/src/input/checks/audit_rules_networkconfig_modification.xml
@@ -113,4 +113,10 @@
     <ind:pattern operation="pattern match">^\-w\s/etc/sysconfig/network\s\-p\swa\s\-k\ssystem\-locale$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
+  <ind:textfilecontent54_object id="NEED_ID" version="1">
+    <ind:path>/etc/audit</ind:path>
+    <ind:filename>audit.rules</ind:filename>
+    <ind:pattern operation="pattern match">^\-w\s/etc/sysconfig/network\-scripts/\s\-p\swa\s\-k\ssystem\-locale$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
 </def-group>
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 6b249b4..887b227 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -246,6 +246,7 @@ ARCH to either b32 or b64 as appropriate for your system:
 -w /etc/issue.net -p wa -k audit_network_modifications
 -w /etc/hosts -p wa -k audit_network_modifications
 -w /etc/sysconfig/network -p wa -k audit_network_modifications
+-w /etc/sysconfig/network-scripts/ -p wa -k audit_network_modifications
 </pre>
 </description>
 <rationale>The network environment should not be modified by anything other than
-- 
1.7.1


--AqsLC8rIMeq19msA--


More information about the scap-security-guide mailing list