[PATCH 1/2] Reversed order of exit, always to always, exit to match rest of audit rules

Andrew Gilmore agilmore2 at gmail.com
Fri Jul 19 17:07:51 UTC 2013


---
 .../audit_rules_networkconfig_modification.xml     |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/RHEL6/input/checks/audit_rules_networkconfig_modification.xml b/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
index be2c90f..eab7914 100644
--- a/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
+++ b/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
@@ -33,7 +33,7 @@
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="object_audit_rules_networkconfig_modification_syscall" version="1">
     <ind:filepath>/etc/audit/audit.rules</ind:filepath>
-    <ind:pattern operation="pattern match">^\-a\s+exit,always\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+sethostname\s+\-S\s+setdomainname\s+\-k\s+[-\w]+\s*$</ind:pattern>
+    <ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+sethostname\s+\-S\s+setdomainname\s+\-k\s+[-\w]+\s*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
   <ind:textfilecontent54_object id="object_audit_rules_networkconfig_modification_etc_issue" version="1">
-- 
1.7.1



More information about the scap-security-guide mailing list