[PATCH 3/4] Updated mappings for CCI-000130

Shawn Wells shawn at redhat.com
Tue Jul 24 09:52:05 UTC 2012


Upon further review to meet 130 the auditd subsystem has to be enabled and properly configured.
- Removed mapping to met_inherently
- Added mappings to enable_auditd_service, enable_auditd_bootloader, auditd_configure_rules
---
 RHEL6/input/auxiliary/srg_support.xml |    2 +-
 RHEL6/input/system/auditing.xml       |    6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/RHEL6/input/auxiliary/srg_support.xml b/RHEL6/input/auxiliary/srg_support.xml
index d2ff409..11e22f5 100644
--- a/RHEL6/input/auxiliary/srg_support.xml
+++ b/RHEL6/input/auxiliary/srg_support.xml
@@ -12,7 +12,7 @@ not clearly relate.
 Red Hat Enterprise Linux meets this requirement by design.
 <!-- We could include discussion of Common Criteria Testing if so desired here. -->
 </description>
-<ref disa="56,223,131,130,132,133,134,159,1694,162,163,164,345,346,872,1493,1494,1495,226,1096,386,34,35,156,186,99,1083,1089,1082,804,764,1209,1214,1237,1248,1265,1269,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1693,1665,1670,1674" />
+<ref disa="56,223,131,132,133,134,159,1694,162,163,164,345,346,872,1493,1494,1495,226,1096,386,34,35,156,186,99,1083,1089,1082,804,764,1209,1214,1237,1248,1265,1269,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1693,1665,1670,1674" />
 </Group> <!-- end met_inherently -->
 
 <Group id="unmet_impractical_guidance">
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 2b10615..56936cf 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -70,7 +70,7 @@ actions will be taken if other obstacles exist.
 </rationale>
 <ident cce="4292-9" />
 <oval id="service_auditd_enabled" />
-<ref nist="CM-6, CM-7" disa="169,172,174,1353,1462,1487,1115,1454,154,067,158,831,1123,1190,1312,1263" />
+<ref nist="CM-6, CM-7" disa="169,172,174,1353,1462,1487,1115,1454,154,067,158,831,1123,1190,1312,1263,130" />
 </Rule>
 
 <Rule id="enable_auditd_bootloader">
@@ -89,7 +89,7 @@ process during boot.
 </rationale>
 <ident cce="15026-8" />
 <oval id="bootloader_audit_argument" />
-<ref nist="AU-2" disa="1464" />
+<ref nist="AU-2" disa="1464,130" />
 </Rule>
 
 <Group id="configure_auditd_data_retention">
@@ -356,7 +356,7 @@ After reviewing all the rules, reading the following sections, and
 editing as needed, the new rules can be activated as follows:
 <pre># service auditd restart</pre>
 </description>
-<ref disa="171,172,1115,1454,1487,1571,1589,880,347,85,1274,1356,374" />
+<ref disa="171,172,1115,1454,1487,1571,1589,880,347,85,1274,1356,374,130" />
 
 <Group id="audit_time_rules">
 <title>Records Events that Modify Date and Time Information</title>
-- 
1.7.1


--UlVJffcvxoiEqYs2--


More information about the scap-security-guide mailing list