[PATCH 09/11] Updated audit_dac_actions

Shawn Wells shawn at redhat.com
Wed Jul 4 06:17:21 UTC 2012


- Changed title of audit_dac_actions to match style of MAC rule title
- MAC and DAC auditing placed immediately after each other increases readability of the guide
- Mapped to CCI-126
---
 rhel6/src/input/system/auditing.xml |   48 +++++++++++++++++-----------------
 1 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 2ab0adf..0633724 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -535,6 +535,30 @@ MAC policy should be audited.</rationale>
 <ref nist="AU-2" />
 </Rule>
 
+<Rule id="audit_dac_actions">
+<title>Record Events that Modify the System's Discretionary
+Access Controls</title>
+<description>At a minimum the audit system should collect file
+permission changes for all users and root. Add the following to
+<tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as
+appropriate for your system:
+<pre>-a always,exit -F arch=ARCH -S chmod -S fchmod -S fchmodat \
+    -F auid&gt;=500 -F auid!=4294967295 -k perm_mod
+    -a always,exit -F arch=ARCH -S chown -S fchown -S fchownat \
+    -S lchown -F auid&gt;=500 -F auid!=4294967295 -k perm_mod
+    -a always,exit -F arch=ARCH -S setxattr -S lsetxattr \
+    -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr \
+    -F auid&gt;=500 -F auid!=4294967295 -k perm_mod</pre>
+</description>
+<rationale>The changing of file permissions could indicate that a user is attempting to
+gain access to information that would otherwise be disallowed. Auditing DAC modifications
+can facilitate the identification of patterns of abuse amoung both authorized and
+unauthorized users.</rationale>
+<ident cce="14058-2" />
+<oval id="audit_rules_dac_modification" />
+<ref nist="AU-2" disa="126"/>
+</Rule>
+
 <Rule id="audit_manual_logon_edits">
 <title> Record Attempts to Alter Logon and Logout Events</title>
 <description> 
@@ -567,30 +591,6 @@ as an attacker attempting to remove evidence of an intrusion.</rationale>
 <!--<ref nist="TODO" />-->
 </Rule>
 
-<Rule id="audit_dac_actions">
-<title>Ensure <tt>auditd</tt> Collects Discretionary Access Control
-Permission Modification Events</title>
-<description>At a minimum the audit system should collect file
-permission changes for all users and root. Add the following to
-<tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as
-appropriate for your system:
-<pre>-a always,exit -F arch=ARCH -S chmod -S fchmod -S fchmodat \
-    -F auid&gt;=500 -F auid!=4294967295 -k perm_mod
--a always,exit -F arch=ARCH -S chown -S fchown -S fchownat \
-    -S lchown -F auid&gt;=500 -F auid!=4294967295 -k perm_mod
--a always,exit -F arch=ARCH -S setxattr -S lsetxattr \
-    -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr \
-    -F auid&gt;=500 -F auid!=4294967295 -k perm_mod</pre>
-</description>
-<rationale>The changing of file permissions could indicate that a user is attempting to
-gain access to information that would otherwise be disallowed. Auditing DAC modifications
-can facilitate the identification of patterns of abuse amoung both authorized and
-unauthorized users.</rationale>
-<ident cce="14058-2" />
-<oval id="audit_rules_dac_modification" />
-<ref nist="AU-2" />
-</Rule>
-
 <Rule id="audit_file_access">
 <title>Ensure <tt>auditd</tt> Collects Unauthorized Access Attempts to Files (unsuccessful)</title>
 <description>At a minimum the audit system should collect
-- 
1.7.1


--jRHKVT23PllUwdXP--


More information about the scap-security-guide mailing list