[PATCH 20/24] Updated audit_sysadmin_actions to watch /etc/sudoers.d/

Shawn Wells shawn at redhat.com
Sat Feb 25 21:48:47 UTC 2012


---
 .../input/checks/audit_rules_sysadmin_actions.xml  |    6 ++++++
 rhel6/src/input/system/auditing.xml                |    5 +++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/rhel6/src/input/checks/audit_rules_sysadmin_actions.xml b/rhel6/src/input/checks/audit_rules_sysadmin_actions.xml
index 1afd221..d0ffeec 100644
--- a/rhel6/src/input/checks/audit_rules_sysadmin_actions.xml
+++ b/rhel6/src/input/checks/audit_rules_sysadmin_actions.xml
@@ -14,10 +14,16 @@
   </definition>
   <ind:textfilecontent54_test check="all" comment="audit sudoers" id="test_audit_rules_sysadmin_actions" version="1">
     <ind:object object_ref="object_audit_rules_sysadmin_actions" />
+    <ind:object object_ref="object_audit_rules_sysadmin_actions_sudoersd" />
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="object_audit_rules_sysadmin_actions" version="1">
     <ind:filepath>/etc/audit/audit.rules</ind:filepath>
     <ind:pattern operation="pattern match">^\-w\s+/etc/sudoers\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
+  <ind:textfilecontent54_object id="object_audit_rules_sysadmin_actions_sudoersd" version="1">
+    <ind:filepath>/etc/audit/audit.rules</ind:filepath>
+    <ind:pattern operation="pattern match">^\-w\s+/etc/sudoers.d/\s+\-k\s+[-\w]+\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
 </def-group>
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index d4955a0..6a3a1f0 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -412,8 +412,9 @@ malicious processes that attempt to delete log files to conceal their presence.<
 administrator actions for all users and root. Add the following to
 <tt>/etc/audit/audit.rules</tt>:
 <br />
-<pre>
--w /etc/sudoers -p wa -k actions</pre>
+<pre># audit_sysadmin_actions
+-w /etc/sudoers -p wa -k audit_sysadmin_actions
+-w /etc/sudoers.d/ -k audit_sysadmin_actions</pre>
 </description>
 <rationale>The actions taken by system administrators should be audited to keep a record
 of what was executed on the system as well as for accountability purposes.</rationale>
-- 
1.7.1


--gBBFr7Ir9EOA20Yy--


More information about the scap-security-guide mailing list