[PATCH 1/2] Audit test fix to match rest of checks, also fixed text doc
Shawn Wells
shawn at redhat.com
Fri Jul 19 19:12:42 UTC 2013
On 7/19/13 2:53 PM, Shawn Wells wrote:
> On 7/19/13 1:47 PM, Andrew Gilmore wrote:
>> ---
>> .../audit_rules_networkconfig_modification.xml | 2 +-
>> RHEL6/input/system/auditing.xml | 2 +-
>> 2 files changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/RHEL6/input/checks/audit_rules_networkconfig_modification.xml b/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
>> index be2c90f..e2fee0e 100644
>> --- a/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
>> +++ b/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
>> @@ -33,7 +33,7 @@
>> </ind:textfilecontent54_test>
>> <ind:textfilecontent54_object id="object_audit_rules_networkconfig_modification_syscall" version="1">
>> <ind:filepath>/etc/audit/audit.rules</ind:filepath>
>> - <ind:pattern operation="pattern match">^\-a\s+exit,always\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+sethostname\s+\-S\s+setdomainname\s+\-k\s+[-\w]+\s*$</ind:pattern>
>> + <ind:pattern operation="pattern match">^\-a\s+(always,exit|exit,always)\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+sethostname\s+\-S\s+setdomainname\s+\-k\s+[-\w]+\s*$</ind:pattern>
Was filing this EMail away, then noticed you switched up that regex
between this and the first patch ;)
The -a option calls for an action of the syscall, then the list to
append to. Valid actions are always and never, so this should really be:
^\-a\s+always,exit\s+(....
Ref "System Call" section of manpage @
http://linux.die.net/man/7/audit.rules
Please revert.
>> <ind:instance datatype="int">1</ind:instance>
>> </ind:textfilecontent54_object>
>> <ind:textfilecontent54_object id="object_audit_rules_networkconfig_modification_etc_issue" version="1">
>> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
>> index b1768ee..4597b6f 100644
>> --- a/RHEL6/input/system/auditing.xml
>> +++ b/RHEL6/input/system/auditing.xml
>> @@ -662,7 +662,7 @@ legitimacy.</rationale>
>> <description>Add the following to <tt>/etc/audit/audit.rules</tt>, setting
>> ARCH to either b32 or b64 as appropriate for your system:
>> <pre># audit_network_modifications
>> --a exit,always -F arch=ARCH -S sethostname -S setdomainname -k audit_network_modifications
>> +-a always,exit -F arch=ARCH -S sethostname -S setdomainname -k audit_network_modifications
>> -w /etc/issue -p wa -k audit_network_modifications
>> -w /etc/issue.net -p wa -k audit_network_modifications
>> -w /etc/hosts -p wa -k audit_network_modifications
>> -- 1.7.1
>
> Ack - thanks for updating the xccdf
--
Shawn Wells
Director, Innovation Programs
shawn at redhat.com | 443.534.0130
@shawndwells
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130719/31994eec/attachment-0001.html>
More information about the scap-security-guide
mailing list