[PATCH 10/64] Mapped configure_auditd_admin_space_left_action to AU-5(d)

Shawn Wells shawn.d.wells at gmail.com
Fri Apr 26 02:05:38 UTC 2013


-------------- next part --------------
>From 1d8b23fa2b952d77a83c893f6e06426b93c6d8ca Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 25 Apr 2013 14:05:51 -0400
Subject: [PATCH 10/64] Mapped configure_auditd_admin_space_left_action to AU-5(d)
 AU-5(d) defines actions for audit failure events

---
 RHEL6/input/system/auditing.xml |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 3b76096..03adfd6 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -359,7 +359,7 @@ Acceptable values are <tt>email</tt>, <tt>suspend</tt>, <tt>single</tt>, and <tt
 allow them to take corrective action prior to any disruption.</rationale>
 <ident cce="27238-5" />
 <oval id="auditd_data_retention_space_left_action" value="var_auditd_space_left_action"/>
-<ref nist="AU-1(b),AU-4" disa="140,143" />
+<ref nist="AU-1(b),AU-4,AU-5(b)" disa="140,143" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -401,7 +401,7 @@ is used, running low on space for audit records should never occur.
 </rationale>
 <ident cce="27239-3" />
 <oval id="auditd_data_retention_admin_space_left_action" value="var_auditd_admin_space_left_action" />
-<ref nist="AU-1(b),AU-4" disa="140,1343" />
+<ref nist="AU-1(b),AU-4,AU-5(b)" disa="140,1343" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
-- 
1.7.1



More information about the scap-security-guide mailing list