[PATCH 07/10] Audit rule requires arch type.

Shawn Wells shawn at redhat.com
Sat Nov 3 02:33:42 UTC 2012


On 11/2/12 12:25 AM, Michele Newman wrote:
> ---
>   RHEL6/input/system/auditing.xml | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
> index e689509..c347936 100644
> --- a/RHEL6/input/system/auditing.xml
> +++ b/RHEL6/input/system/auditing.xml
> @@ -1261,11 +1261,11 @@ of what was executed on the system as well as for accountability purposes.</rati
>   <Rule id="audit_kernel_module_loading">
>   <title>Ensure <tt>auditd</tt> Collects Information on Kernel Module Loading and Unloading</title>
>   <description>Add the following to <tt>/etc/audit/audit.rules</tt> in order
> -to capture kernel module loading and unloading events:
> +to capture kernel module loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system:
>   <pre>-w /sbin/insmod -p x -k modules
>   -w /sbin/rmmod -p x -k modules
>   -w /sbin/modprobe -p x -k modules
> --a always,exit -S init_module -S delete_module -k modules</pre>
> +-a always,exit -F arch=<i>ARCH</i> -S init_module -S delete_module -k modules</pre>
>   </description>
>   <ocil>
>   <audit-syscall-check-macro syscall="init_module" />
> -- 1.8.0

Good catch. Ack.


More information about the scap-security-guide mailing list