[PATCH 10/64] Mapped configure_auditd_admin_space_left_action to AU-5(d)
Shawn Wells
shawn.d.wells at gmail.com
Fri Apr 26 02:05:38 UTC 2013
-------------- next part --------------
>From 1d8b23fa2b952d77a83c893f6e06426b93c6d8ca Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 25 Apr 2013 14:05:51 -0400
Subject: [PATCH 10/64] Mapped configure_auditd_admin_space_left_action to AU-5(d)
AU-5(d) defines actions for audit failure events
---
RHEL6/input/system/auditing.xml | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 3b76096..03adfd6 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -359,7 +359,7 @@ Acceptable values are <tt>email</tt>, <tt>suspend</tt>, <tt>single</tt>, and <tt
allow them to take corrective action prior to any disruption.</rationale>
<ident cce="27238-5" />
<oval id="auditd_data_retention_space_left_action" value="var_auditd_space_left_action"/>
-<ref nist="AU-1(b),AU-4" disa="140,143" />
+<ref nist="AU-1(b),AU-4,AU-5(b)" disa="140,143" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -401,7 +401,7 @@ is used, running low on space for audit records should never occur.
</rationale>
<ident cce="27239-3" />
<oval id="auditd_data_retention_admin_space_left_action" value="var_auditd_admin_space_left_action" />
-<ref nist="AU-1(b),AU-4" disa="140,1343" />
+<ref nist="AU-1(b),AU-4,AU-5(b)" disa="140,1343" />
<tested by="DS" on="20121024"/>
</Rule>
--
1.7.1
More information about the scap-security-guide
mailing list