[PATCH 3/4] Updated mappings for CCI-000130
Shawn Wells
shawn at redhat.com
Tue Jul 24 09:52:05 UTC 2012
Upon further review to meet 130 the auditd subsystem has to be enabled and properly configured.
- Removed mapping to met_inherently
- Added mappings to enable_auditd_service, enable_auditd_bootloader, auditd_configure_rules
---
RHEL6/input/auxiliary/srg_support.xml | 2 +-
RHEL6/input/system/auditing.xml | 6 +++---
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/RHEL6/input/auxiliary/srg_support.xml b/RHEL6/input/auxiliary/srg_support.xml
index d2ff409..11e22f5 100644
--- a/RHEL6/input/auxiliary/srg_support.xml
+++ b/RHEL6/input/auxiliary/srg_support.xml
@@ -12,7 +12,7 @@ not clearly relate.
Red Hat Enterprise Linux meets this requirement by design.
<!-- We could include discussion of Common Criteria Testing if so desired here. -->
</description>
-<ref disa="56,223,131,130,132,133,134,159,1694,162,163,164,345,346,872,1493,1494,1495,226,1096,386,34,35,156,186,99,1083,1089,1082,804,764,1209,1214,1237,1248,1265,1269,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1693,1665,1670,1674" />
+<ref disa="56,223,131,132,133,134,159,1694,162,163,164,345,346,872,1493,1494,1495,226,1096,386,34,35,156,186,99,1083,1089,1082,804,764,1209,1214,1237,1248,1265,1269,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1693,1665,1670,1674" />
</Group> <!-- end met_inherently -->
<Group id="unmet_impractical_guidance">
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 2b10615..56936cf 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -70,7 +70,7 @@ actions will be taken if other obstacles exist.
</rationale>
<ident cce="4292-9" />
<oval id="service_auditd_enabled" />
-<ref nist="CM-6, CM-7" disa="169,172,174,1353,1462,1487,1115,1454,154,067,158,831,1123,1190,1312,1263" />
+<ref nist="CM-6, CM-7" disa="169,172,174,1353,1462,1487,1115,1454,154,067,158,831,1123,1190,1312,1263,130" />
</Rule>
<Rule id="enable_auditd_bootloader">
@@ -89,7 +89,7 @@ process during boot.
</rationale>
<ident cce="15026-8" />
<oval id="bootloader_audit_argument" />
-<ref nist="AU-2" disa="1464" />
+<ref nist="AU-2" disa="1464,130" />
</Rule>
<Group id="configure_auditd_data_retention">
@@ -356,7 +356,7 @@ After reviewing all the rules, reading the following sections, and
editing as needed, the new rules can be activated as follows:
<pre># service auditd restart</pre>
</description>
-<ref disa="171,172,1115,1454,1487,1571,1589,880,347,85,1274,1356,374" />
+<ref disa="171,172,1115,1454,1487,1571,1589,880,347,85,1274,1356,374,130" />
<Group id="audit_time_rules">
<title>Records Events that Modify Date and Time Information</title>
--
1.7.1
--UlVJffcvxoiEqYs2--
More information about the scap-security-guide
mailing list