[PATCH 10/20] Macro was referring to wrong audit check.
Michele Newman
mnewman at redhat.com
Wed Oct 31 01:26:35 UTC 2012
---
RHEL6/input/system/auditing.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 64507a4..73a9233 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -780,7 +780,7 @@ If the system is 64 bit then also add the following:
-k perm_mod</pre>
</description>
<ocil>
-<audit-syscall-check-macro syscall="fchmod" />
+<audit-syscall-check-macro syscall="chown" />
</ocil>
<rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
--
1.8.0
More information about the scap-security-guide
mailing list