[PATCH 2/4] typo fixes to checks in auditing section
Jeffrey Blank
blank at eclipse.ncsc.mil
Tue Sep 25 12:51:39 UTC 2012
Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
RHEL6/input/system/auditing.xml | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 5cdb2ff..a8ebc90 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -471,7 +471,7 @@ desired, but is not required. See an example of multiple combined syscalls:
-k audit_time_rules</pre>
</description>
<ocil>
-<audit-syscall-check-macro syscall="fchmod" />
+<audit-syscall-check-macro syscall="adjtimex" />
</ocil>
<rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activites in log files as well as to confuse network services that
@@ -499,7 +499,7 @@ desired, but is not required. See an example of multiple combined syscalls:
-k audit_time_rules</pre>
</description>
<ocil>
-<audit-syscall-check-macro syscall="fchmod" />
+<audit-syscall-check-macro syscall="settimeofday" />
</ocil>
<rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activites in log files as well as to confuse network services that
@@ -525,7 +525,7 @@ See an example of multiple combined syscalls:
-k audit_time_rules</pre>
</description>
<ocil>
-<audit-syscall-check-macro syscall="fchmod" />
+<audit-syscall-check-macro syscall="stime" />
</ocil>
<rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activites in log files as well as to confuse network services that
@@ -553,7 +553,7 @@ desired, but is not required. See an example of multiple combined syscalls:
-k audit_time_rules</pre>
</description>
<ocil>
-<audit-syscall-check-macro syscall="fchmod" />
+<audit-syscall-check-macro syscall="clock_settime" />
</ocil>
<rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activites in log files as well as to confuse network services that
--
1.7.1
More information about the scap-security-guide
mailing list