[PATCH 09/20] The check is refering to chmod not fchmod.

Michele Newman mnewman at redhat.com
Wed Oct 31 01:26:34 UTC 2012


---
 RHEL6/input/system/auditing.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index d85672d..64507a4 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -756,7 +756,7 @@ gain access to information that would otherwise be disallowed. Auditing DAC modi
 can facilitate the identification of patterns of abuse among both authorized and
 unauthorized users.</rationale>
 <ocil clause="the system isn't configured to audit permission changes">
-<audit-syscall-check-macro syscall="fchmod" />
+<audit-syscall-check-macro syscall="chmod" />
 </ocil>
 <warning category="general">Note that these rules can be configured in a 
 number of ways while still acheiving the desired effect.  Here the system calls 
-- 
1.8.0



More information about the scap-security-guide mailing list