[PATCH 07/10] Audit rule requires arch type.
Shawn Wells
shawn at redhat.com
Sat Nov 3 02:33:42 UTC 2012
On 11/2/12 12:25 AM, Michele Newman wrote:
> ---
> RHEL6/input/system/auditing.xml | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
> index e689509..c347936 100644
> --- a/RHEL6/input/system/auditing.xml
> +++ b/RHEL6/input/system/auditing.xml
> @@ -1261,11 +1261,11 @@ of what was executed on the system as well as for accountability purposes.</rati
> <Rule id="audit_kernel_module_loading">
> <title>Ensure <tt>auditd</tt> Collects Information on Kernel Module Loading and Unloading</title>
> <description>Add the following to <tt>/etc/audit/audit.rules</tt> in order
> -to capture kernel module loading and unloading events:
> +to capture kernel module loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system:
> <pre>-w /sbin/insmod -p x -k modules
> -w /sbin/rmmod -p x -k modules
> -w /sbin/modprobe -p x -k modules
> --a always,exit -S init_module -S delete_module -k modules</pre>
> +-a always,exit -F arch=<i>ARCH</i> -S init_module -S delete_module -k modules</pre>
> </description>
> <ocil>
> <audit-syscall-check-macro syscall="init_module" />
> -- 1.8.0
Good catch. Ack.
More information about the scap-security-guide
mailing list