[PATCH 12/17] Mapped CCI-001297 to aide_periodic_cron_checking
Willy Santos
wsantos at redhat.com
Wed May 2 15:23:25 UTC 2012
On 05/01/2012 08:29 PM, Shawn Wells wrote:
> On 5/1/12 7:18 PM, Willy Santos wrote:
>> CCI-001297 requires teh detection of unauthorized changes to software
>> and information, aide_periodic_cron_checking meets this requirement.
>>
>> Signed-off-by: Willy Santos<wsantos at redhat.com>
>> ---
>> rhel6/src/input/system/software/integrity.xml | 2 +-
>> 1 files changed, 1 insertions(+), 1 deletions(-)
>>
>> diff --git a/rhel6/src/input/system/software/integrity.xml
>> b/rhel6/src/input/system/software/integrity.xml
>> index 902ad8f..5fd76c2 100644
>> --- a/rhel6/src/input/system/software/integrity.xml
>> +++ b/rhel6/src/input/system/software/integrity.xml
>> @@ -92,7 +92,7 @@ AIDE can be executed periodically through other
>> means; this is merely one exampl
>> By default, AIDE does not install itself for periodic execution.
>> Periodically
>> running AIDE may reveal unexpected changes in installed files.
>> </rationale>
>> -<ref nist="CM-6, SC-28, SI-7" disa="416"/>
>> +<ref nist="CM-6, SC-28, SI-7" disa="416,1297"/>
>> </Rule>
>>
>> <Rule id="aide_verify_integrity_manually">
>
>
>
> Nack
>
> Associating this with only aide_periodic_cron_checking could lead one
> to believe they only have to install aide and throw it into a cron
> job, versus stepping through the other rules in the section. I'd
> rather see this associated with the overall aide group vs a specific
> rule.
Agreed. Was debating the placement myself. I'll make the change and
submit new patch.
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/scap-security-guide
More information about the scap-security-guide
mailing list