[PATCH 15/22] OVAL signoff + remediation: auditd_data_retention_admin_space_left_action

Shawn Wells shawn.d.wells at gmail.com
Mon Sep 16 01:33:16 UTC 2013


-------------- next part --------------
>From 774aced68a92027d20a5157cb80bae748ba433a5 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 15 Sep 2013 17:12:17 -0400
Subject: [PATCH 15/22] OVAL signoff + remediation: auditd_data_retention_admin_space_left_action
 - OVAL signoff
 - Updated XCCDF/OVAL namings
 - Remediation script

TESTING;
[root at SSG-RHEL6 checks]# var_auditd_admin_space_left_action=SINGLE ; export var_auditd_admin_space_left_action
[root at SSG-RHEL6 checks]# ./testcheck.py auditd_data_retention_admin_space_left_action.xml
external_variable with id : var_auditd_admin_space_left_action
Evaluating with OVAL tempfile : /tmp/auditd_data_retention_admin_space_left_actionlbbPyb.xml
Writing results to : /tmp/auditd_data_retention_admin_space_left_actionlbbPyb.xml-results
Definition oval:scap-security-guide.testing:def:166: true
Evaluation done.
[root at SSG-RHEL6 checks]# sed -i "s/admin_space_left_action.*/admin_space_left_action = BROKE/g" /etc/audit/auditd.conf
[root at SSG-RHEL6 checks]# ./testcheck.py auditd_data_retention_admin_space_left_action.xml
external_variable with id : var_auditd_admin_space_left_action
Evaluating with OVAL tempfile : /tmp/auditd_data_retention_admin_space_left_actionJNf4lp.xml
Writing results to : /tmp/auditd_data_retention_admin_space_left_actionJNf4lp.xml-results
Definition oval:scap-security-guide.testing:def:166: false
Evaluation done.
---
 ...ditd_data_retention_admin_space_left_action.xml |    1 +
 ...uditd_data_retention_admin_space_left_action.sh |    8 ++++++++
 RHEL6/input/profiles/common.xml                    |    2 +-
 RHEL6/input/profiles/fisma-medium-rhel6-server.xml |    2 +-
 RHEL6/input/profiles/nist-CL-IL-AL.xml             |    2 +-
 RHEL6/input/profiles/test.xml                      |    2 +-
 RHEL6/input/system/auditing.xml                    |   17 +++--------------
 7 files changed, 16 insertions(+), 18 deletions(-)
 create mode 100644 RHEL6/input/fixes/bash/auditd_data_retention_admin_space_left_action.sh

diff --git a/RHEL6/input/checks/auditd_data_retention_admin_space_left_action.xml b/RHEL6/input/checks/auditd_data_retention_admin_space_left_action.xml
index e6683a6..2829104 100644
--- a/RHEL6/input/checks/auditd_data_retention_admin_space_left_action.xml
+++ b/RHEL6/input/checks/auditd_data_retention_admin_space_left_action.xml
@@ -6,6 +6,7 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>admin_space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
+      <reference source="swells" ref_id="20130915" ref_url="test_attestation" />
     </metadata>
    
     <criteria>
diff --git a/RHEL6/input/fixes/bash/auditd_data_retention_admin_space_left_action.sh b/RHEL6/input/fixes/bash/auditd_data_retention_admin_space_left_action.sh
new file mode 100644
index 0000000..68d684f
--- /dev/null
+++ b/RHEL6/input/fixes/bash/auditd_data_retention_admin_space_left_action.sh
@@ -0,0 +1,8 @@
+source ./templates/support.sh
+populate var_auditd_admin_space_left_action
+
+grep -q ^admin_space_left_action /etc/audit/auditd.conf && \
+  sed -i "s/admin_space_left_action.*/admin_space_left_action = $var_auditd_space_left_action/g" /etc/audit/auditd.conf
+if ! [ $? -eq 0 ]; then
+    echo "admin_space_left_action = $var_auditd_space_left_action" >> /etc/audit/auditd.conf
+fi
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index ab099be..dc6cd10 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -112,7 +112,7 @@
 <select idref="configure_auditd_num_logs" selected="true"/>
 <select idref="configure_auditd_max_log_file" selected="true"/>
 <select idref="configure_auditd_max_log_file_action" selected="true"/>
-<select idref="configure_auditd_admin_space_left_action" selected="true"/>
+<select idref="auditd_data_retention_admin_space_left_action" selected="true"/>
 
 <!-- <select idref="audit_time_rules" selected="true"/> -->
 <select idref="audit_rules_time_adjtimex" selected="true"/>
diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
index 649a7c2..d50a06d 100644
--- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
@@ -195,7 +195,7 @@
 <select idref="configure_auditd_max_log_file_action" selected="true" />
 <select idref="configure_auditd_space_left_action" selected="true" />
 <refine-value idref="var_auditd_admin_space_left_action" selector="halt" />
-<select idref="configure_auditd_admin_space_left_action" selected="true" />
+<select idref="auditd_data_retention_admin_space_left_action" selected="true" />
 <select idref="configure_auditd_action_mail_acct" selected="true" />
 <select idref="configure_auditd_audispd" selected="true" />
 
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index f28611d..a85fc15 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -268,7 +268,7 @@ assurance."</description>
 <select idref="configure_auditd_max_log_file" selected="true" \>
 <select idref="configure_auditd_max_log_file_action" selected="true" \>
 <select idref="configure_auditd_space_left_action" selected="true" \>
-<select idref="configure_auditd_admin_space_left_action" selected="true" \>
+<select idref="auditd_data_retention_admin_space_left_action" selected="true" \>
 <select idref="configure_auditd_action_mail_acct" selected="true" \>
 <select idref="configure_auditd_audispd" selected="true" \>
 
diff --git a/RHEL6/input/profiles/test.xml b/RHEL6/input/profiles/test.xml
index bad88f5..e980e04 100644
--- a/RHEL6/input/profiles/test.xml
+++ b/RHEL6/input/profiles/test.xml
@@ -33,7 +33,7 @@
 <select idref="configure_auditd_max_log_file" selected="true"/>
 <select idref="configure_auditd_action_mail_acct" selected="true"/>
 <select idref="configure_auditd_space_left_action" selected="true"/>
-<select idref="configure_auditd_admin_space_left_action" selected="true"/>
+<select idref="auditd_data_retention_admin_space_left_action" selected="true"/>
 <select idref="configure_auditd_max_log_file_action" selected="true"/>
 
 <refine-value idref="var_auditd_num_logs" selector="5"/>
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index cfb1425..ea4e2d8 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -363,30 +363,19 @@ allow them to take corrective action prior to any disruption.</rationale>
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
-<Rule id="configure_auditd_admin_space_left_action" severity="medium">
+<Rule id="auditd_data_retention_admin_space_left_action" severity="medium">
 <title>Configure auditd admin_space_left Action on Low Disk Space</title>
 <description>The <tt>auditd</tt> service can be configured to take an action
 when disk space is running low but prior to running out of space completely. 
 Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line,
 substituting <i>ACTION</i> appropriately:
 <pre>admin_space_left_action = <i>ACTION</i></pre>
-Possible values for <i>ACTION</i> are described in the <tt>auditd.conf</tt> man page.
-These include:
-<ul>
-<li><tt>ignore</tt></li>
-<li><tt>syslog</tt></li>
-<li><tt>email</tt></li>
-<li><tt>exec</tt></li>
-<li><tt>suspend</tt></li>
-<li><tt>single</tt></li>
-<li><tt>halt</tt></li>
-</ul>
 Set this value to <tt>single</tt> to cause the system to switch to single user
 mode for corrective action. Acceptable values also include <tt>suspend</tt> and
 <tt>halt</tt>. For certain systems, the need for availability
 outweighs the need to log all actions, and a different setting should be
-determined.
+determined. Details regarding all possible values for <i>ACTION</i> are described in the
+<tt>auditd.conf</tt> man page.
 </description>
 <ocil clause="the system is not configured to switch to single user
 mode for corrective action">
-- 
1.7.1



More information about the scap-security-guide mailing list