[PATCH 10/21] Check syscall audits explicitly to avoid partial matches
Shawn Wells
shawn at redhat.com
Mon Jul 28 03:26:57 UTC 2014
From: Leland Steinke <leland.j.steinke.ctr at mail.mil>
- Update VRelease key
- Add OCIL for unlinkat, renameat
- Update grep regex from 'grep' to 'grep -w'
Signed-off-by: Leland Steinke <leland.j.steinke.ctr at mail.mil>
---
RHEL/6/input/auxiliary/stig_overlay.xml | 2 +-
RHEL/6/input/system/auditing.xml | 2 ++
2 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/RHEL/6/input/auxiliary/stig_overlay.xml b/RHEL/6/input/auxiliary/stig_overlay.xml
index 2e922d1..bc540d6 100644
--- a/RHEL/6/input/auxiliary/stig_overlay.xml
+++ b/RHEL/6/input/auxiliary/stig_overlay.xml
@@ -569,7 +569,7 @@
<title>The audit system must be configured to audit successful file system mounts.</title>
</overlay>
<overlay owner="disastig" ruleid="audit_rules_file_deletion_events" ownerid="RHEL-06-000200" disa="172" severity="low">
- <VMSinfo VKey="38575" SVKey="50376" VRelease="2" />
+ <VMSinfo VKey="38575" SVKey="50376" VRelease="3" />
<title>The audit system must be configured to audit user deletions of files and programs.</title>
</overlay>
<overlay owner="disastig" ruleid="audit_sysadmin_actions" ownerid="RHEL-06-000201" disa="172" severity="low">
diff --git a/RHEL/6/input/system/auditing.xml b/RHEL/6/input/system/auditing.xml
index e25f890..6c9f696 100644
--- a/RHEL/6/input/system/auditing.xml
+++ b/RHEL/6/input/system/auditing.xml
@@ -1210,7 +1210,9 @@ appropriate for your system:
</description>
<ocil>
<audit-syscall-check-macro syscall="unlink" />
+<audit-syscall-check-macro syscall="unlinkat" />
<audit-syscall-check-macro syscall="rename" />
+<audit-syscall-check-macro syscall="renameat" />
</ocil>
<rationale>Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
--
1.7.1
More information about the scap-security-guide
mailing list