[PATCH 0/1] Broke apart auditd rules/prose for time changes

Jeffrey Blank blank at eclipse.ncsc.mil
Wed Jun 20 22:16:10 UTC 2012


Ah, yes, after thinking about it for a bit, this makes sense.

I had some concerns about going overboard on granularity, but as you can
see in the RHEL 5 manual STIG
http://people.redhat.com/swells/scap-security-guide-0.1/output/rhel5-table-stig-manual.html

...that one of our future project consumers also felt that this was the
right level of granularity.

Ack / Thanks!




On 06/18/2012 10:28 AM, Kevin Spargur wrote:
> Broke apart the auditd rule for time changes into individual elements
> to better support being able to define these rules in a variety of ways.
> Also added a couple generic architecture tests.  Note that the architecture
> tests have a class of miscellaneous rather than inventory.  Per OVAL 
> specification Version 5.10.1 Revision 1 an oval class of inventory "describes
> OVAL Definitions that check to see if a piece of software is installed on a 
> system."
> 
> Signed-off-by: Kevin Spargur <kspargur at redhat.com>
> 
> Kevin Spargur (1):
>   Broke apart auditd rules/prose for time changes, broke out
>     architecture tests
> 
>  .../src/input/checks/audit_rules_time_adjtimex.xml |   57 +++++++++
>  .../checks/audit_rules_time_clock_settime.xml      |   57 +++++++++
>  .../input/checks/audit_rules_time_settimeofday.xml |   57 +++++++++
>  rhel6/src/input/checks/audit_rules_time_stime.xml  |   41 +++++++
>  .../checks/audit_rules_time_watch_localtime.xml    |   33 +++++
>  .../input/checks/system_info_architecture_x86.xml  |   30 +++++
>  .../checks/system_info_architecture_x86_64.xml     |   30 +++++
>  rhel6/src/input/profiles/common.xml                |    8 +-
>  rhel6/src/input/system/auditing.xml                |  126 ++++++++++++++++++--
>  9 files changed, 427 insertions(+), 12 deletions(-)
>  create mode 100644 rhel6/src/input/checks/audit_rules_time_adjtimex.xml
>  create mode 100644 rhel6/src/input/checks/audit_rules_time_clock_settime.xml
>  create mode 100644 rhel6/src/input/checks/audit_rules_time_settimeofday.xml
>  create mode 100644 rhel6/src/input/checks/audit_rules_time_stime.xml
>  create mode 100644 rhel6/src/input/checks/audit_rules_time_watch_localtime.xml
>  create mode 100644 rhel6/src/input/checks/system_info_architecture_x86.xml
>  create mode 100644 rhel6/src/input/checks/system_info_architecture_x86_64.xml
> 


More information about the scap-security-guide mailing list