[PATCH 2/4] typo fixes to checks in auditing section

Jeffrey Blank blank at eclipse.ncsc.mil
Tue Sep 25 12:51:39 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/system/auditing.xml |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 5cdb2ff..a8ebc90 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -471,7 +471,7 @@ desired, but is not required. See an example of multiple combined syscalls:
 -k audit_time_rules</pre>
 </description>
 <ocil>
-<audit-syscall-check-macro syscall="fchmod" />
+<audit-syscall-check-macro syscall="adjtimex" />
 </ocil>
 <rationale>Arbitrary changes to the system time can be used to obfuscate 
 nefarious activites in log files as well as to confuse network services that 
@@ -499,7 +499,7 @@ desired, but is not required. See an example of multiple combined syscalls:
 -k audit_time_rules</pre>
 </description>
 <ocil>
-<audit-syscall-check-macro syscall="fchmod" />
+<audit-syscall-check-macro syscall="settimeofday" />
 </ocil>
 <rationale>Arbitrary changes to the system time can be used to obfuscate 
 nefarious activites in log files as well as to confuse network services that 
@@ -525,7 +525,7 @@ See an example of multiple combined syscalls:
 -k audit_time_rules</pre>
 </description>
 <ocil>
-<audit-syscall-check-macro syscall="fchmod" />
+<audit-syscall-check-macro syscall="stime" />
 </ocil>
 <rationale>Arbitrary changes to the system time can be used to obfuscate 
 nefarious activites in log files as well as to confuse network services that 
@@ -553,7 +553,7 @@ desired, but is not required. See an example of multiple combined syscalls:
 -k audit_time_rules</pre>
 </description>
 <ocil>
-<audit-syscall-check-macro syscall="fchmod" />
+<audit-syscall-check-macro syscall="clock_settime" />
 </ocil>
 <rationale>Arbitrary changes to the system time can be used to obfuscate 
 nefarious activites in log files as well as to confuse network services that 
-- 
1.7.1



More information about the scap-security-guide mailing list