[PATCH 10/17] Mapped CCI-001589 to auditd_configure_rules

Shawn Wells shawn at redhat.com
Wed May 2 00:21:04 UTC 2012


On 5/1/12 7:18 PM, Willy Santos wrote:
> CCI-001589 requires the tracking of unauthorized, security-relevant configuration changes. auditd provides the mechanism for the tracking of such events.
>
> Signed-off-by: Willy Santos<wsantos at redhat.com>
> ---
>   rhel6/src/input/system/auditing.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
> index 5b0ceb4..c79471f 100644
> --- a/rhel6/src/input/system/auditing.xml
> +++ b/rhel6/src/input/system/auditing.xml
> @@ -133,7 +133,7 @@ After reviewing all the rules, reading the following sections, and
>   editing as needed, activate the new rules:
>   <pre># service auditd restart</pre>
>   </description>
> -<ref disa="171,172,1115,1454,1487,1571" />
> +<ref disa="171,172,1115,1454,1487,1571,1589" />
>
>   <Rule id="audit_time_rules">
>   <title>Records Events that Modify Date and Time Information</title>


Ack


More information about the scap-security-guide mailing list