[PATCH 1/2] Audit test fix to match rest of checks, also fixed text doc

Andrew Gilmore agilmore2 at gmail.com
Fri Jul 19 19:18:14 UTC 2013


Great! However, 1/2 of the audit checks have this same syntax, so
should I fix all of these tests?





On Fri, Jul 19, 2013 at 1:12 PM, Shawn Wells <shawn at redhat.com> wrote:
> On 7/19/13 2:53 PM, Shawn Wells wrote:
>
> On 7/19/13 1:47 PM, Andrew Gilmore wrote:
>
> ---
>  .../audit_rules_networkconfig_modification.xml     |    2 +-
>  RHEL6/input/system/auditing.xml                    |    2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
> b/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
> index be2c90f..e2fee0e 100644
> --- a/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
> +++ b/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
> @@ -33,7 +33,7 @@
>    </ind:textfilecontent54_test>
>    <ind:textfilecontent54_object
> id="object_audit_rules_networkconfig_modification_syscall" version="1">
>      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
> -    <ind:pattern operation="pattern
> match">^\-a\s+exit,always\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+sethostname\s+\-S\s+setdomainname\s+\-k\s+[-\w]+\s*$</ind:pattern>
> +    <ind:pattern operation="pattern
> match">^\-a\s+(always,exit|exit,always)\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+sethostname\s+\-S\s+setdomainname\s+\-k\s+[-\w]+\s*$</ind:pattern>
>
>
> Was filing this EMail away, then noticed you switched up that regex between
> this and the first patch ;)
>
> The -a option calls for an action of the syscall, then the list to append
> to. Valid actions are always and never, so this should really be:
>
> ^\-a\s+always,exit\s+(....
>
> Ref "System Call" section of manpage @
> http://linux.die.net/man/7/audit.rules
>
> Please revert.
>
>
>
>      <ind:instance datatype="int">1</ind:instance>
>    </ind:textfilecontent54_object>
>    <ind:textfilecontent54_object
> id="object_audit_rules_networkconfig_modification_etc_issue" version="1">
> diff --git a/RHEL6/input/system/auditing.xml
> b/RHEL6/input/system/auditing.xml
> index b1768ee..4597b6f 100644
> --- a/RHEL6/input/system/auditing.xml
> +++ b/RHEL6/input/system/auditing.xml
> @@ -662,7 +662,7 @@ legitimacy.</rationale>
>  <description>Add the following to <tt>/etc/audit/audit.rules</tt>, setting
>  ARCH to either b32 or b64 as appropriate for your system:
>  <pre># audit_network_modifications
> --a exit,always -F arch=ARCH -S sethostname -S setdomainname -k
> audit_network_modifications
> +-a always,exit -F arch=ARCH -S sethostname -S setdomainname -k
> audit_network_modifications
>  -w /etc/issue -p wa -k audit_network_modifications
>  -w /etc/issue.net -p wa -k audit_network_modifications
>  -w /etc/hosts -p wa -k audit_network_modifications
> --
> 1.7.1
>
>
> Ack - thanks for updating the xccdf
>
>
>
> --
> Shawn Wells
> Director, Innovation Programs
> shawn at redhat.com | 443.534.0130
> @shawndwells
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>


More information about the scap-security-guide mailing list