[PATCH 17/24] Modified audit_network_modifications to watch /etc/sysconfig/network-scripts/ directory - Modified audit_network_modifications to watch /etc/sysconfig/network-scripts/ directory - Updated audit_rules_networkconfig_modification.xml for the check as well
Shawn Wells
shawn at redhat.com
Sat Feb 25 20:24:46 UTC 2012
---
.../audit_rules_networkconfig_modification.xml | 6 ++++++
rhel6/src/input/system/auditing.xml | 1 +
2 files changed, 7 insertions(+), 0 deletions(-)
diff --git a/rhel6/src/input/checks/audit_rules_networkconfig_modification.xml b/rhel6/src/input/checks/audit_rules_networkconfig_modification.xml
index 1c6b6b2..dcdf3e6 100644
--- a/rhel6/src/input/checks/audit_rules_networkconfig_modification.xml
+++ b/rhel6/src/input/checks/audit_rules_networkconfig_modification.xml
@@ -113,4 +113,10 @@
<ind:pattern operation="pattern match">^\-w\s/etc/sysconfig/network\s\-p\swa\s\-k\ssystem\-locale$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
+ <ind:textfilecontent54_object id="NEED_ID" version="1">
+ <ind:path>/etc/audit</ind:path>
+ <ind:filename>audit.rules</ind:filename>
+ <ind:pattern operation="pattern match">^\-w\s/etc/sysconfig/network\-scripts/\s\-p\swa\s\-k\ssystem\-locale$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
</def-group>
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 6b249b4..887b227 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -246,6 +246,7 @@ ARCH to either b32 or b64 as appropriate for your system:
-w /etc/issue.net -p wa -k audit_network_modifications
-w /etc/hosts -p wa -k audit_network_modifications
-w /etc/sysconfig/network -p wa -k audit_network_modifications
+-w /etc/sysconfig/network-scripts/ -p wa -k audit_network_modifications
</pre>
</description>
<rationale>The network environment should not be modified by anything other than
--
1.7.1
--AqsLC8rIMeq19msA--
More information about the scap-security-guide
mailing list