[PATCH 10/20] Macro was referring to wrong audit check.

Michele Newman mnewman at redhat.com
Wed Oct 31 01:26:35 UTC 2012


---
 RHEL6/input/system/auditing.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 64507a4..73a9233 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -780,7 +780,7 @@ If the system is 64 bit then also add the following:
     -k perm_mod</pre>
 </description>
 <ocil>
-<audit-syscall-check-macro syscall="fchmod" />
+<audit-syscall-check-macro syscall="chown" />
 </ocil>
 <rationale>The changing of file permissions could indicate that a user is attempting to
 gain access to information that would otherwise be disallowed. Auditing DAC modifications
-- 
1.8.0



More information about the scap-security-guide mailing list