[PATCH 21/24] Created audit_sysctl_parameters Created audit_sysctl_parameters to audit sysctl changes Need to create matching cce
Shawn Wells
shawn at redhat.com
Sat Feb 25 21:58:21 UTC 2012
---
rhel6/src/input/system/auditing.xml | 13 +++++++++++++
1 files changed, 13 insertions(+), 0 deletions(-)
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 6a3a1f0..fc618d0 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -443,6 +443,19 @@ to have an audit trail of modules that have been introduced into the kernel.</ra
<ref nist="AU-2" />
</Rule>
+<Rule id="audit_sysctl_parameters">
+<title>Audit Changes to Kernel Parameters</title>
+<description>User definable kernel configuration details are held within the <tt>/etc/sysctl.conf</tt> file. To audit changes to this file, add the following to <tt>/etc/audit/audit.rules</tt>:
+<br />
+<pre># audit_sysctl_parameters
+-w /etc/sysctl.conf -p wa -k audit_sysctl_parameters</pre>
+</description>
+<rationale></rationale>
+<ident cce="TBD" />
+<oval id="TBD" />
+<ref nist="TBD" />
+</Rule>
+
<Rule id="audit_system_startup_scripts">
<title>Audit Alterations to System Startup Scripts</title>
<description>Red Hat Enterprise Linux 6 utilizes the <tt>init</tt> subsystem to boot and start/stop services. To audit the init process add the following lines to <tt>/etc/audit/audit.rules</tt>:
--
1.7.1
--UlVJffcvxoiEqYs2--
More information about the scap-security-guide
mailing list