[PATCH 4/6] removed reference to CCI 143 in auditd admin_space_left_action rule, and removed reference to CCI 169 in auditd enabled rule, per DISA FSO comments (rows 79, 101)

David Smith dsmith at eclipse.ncsc.mil
Wed Jan 2 18:09:38 UTC 2013


Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
 RHEL6/input/system/auditing.xml |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 1decfed..0b689f1 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -93,7 +93,7 @@ actions will be taken if other obstacles exist.
 </rationale>
 <ident cce="27058-7" />
 <oval id="service_auditd_enabled" />
-<ref nist="AU-1, CM-6" disa="347,169,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" />
+<ref nist="AU-1, CM-6" disa="347,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -397,7 +397,7 @@ audit records. If a separate partition or logical volume of adequate size
 is used, running low on space for audit records should never occur.
 </rationale>
 <oval id="auditd_data_retention_admin_space_left_action" value="var_auditd_admin_space_left_action" />
-<ref nist="AU-4, CM-6" disa="140,143,1343" />
+<ref nist="AU-4, CM-6" disa="140,1343" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
-- 
1.7.1



More information about the scap-security-guide mailing list