[PATCH 10/21] Check syscall audits explicitly to avoid partial matches

Shawn Wells shawn at redhat.com
Mon Jul 28 03:26:57 UTC 2014


From: Leland Steinke <leland.j.steinke.ctr at mail.mil>

- Update VRelease key
- Add OCIL for unlinkat, renameat
- Update grep regex from 'grep' to 'grep -w'

Signed-off-by: Leland Steinke <leland.j.steinke.ctr at mail.mil>
---
 RHEL/6/input/auxiliary/stig_overlay.xml |    2 +-
 RHEL/6/input/system/auditing.xml        |    2 ++
 2 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/RHEL/6/input/auxiliary/stig_overlay.xml b/RHEL/6/input/auxiliary/stig_overlay.xml
index 2e922d1..bc540d6 100644
--- a/RHEL/6/input/auxiliary/stig_overlay.xml
+++ b/RHEL/6/input/auxiliary/stig_overlay.xml
@@ -569,7 +569,7 @@
 		<title>The audit system must be configured to audit successful file system mounts.</title>
 	</overlay>
 	<overlay owner="disastig" ruleid="audit_rules_file_deletion_events" ownerid="RHEL-06-000200" disa="172" severity="low">
-		<VMSinfo VKey="38575" SVKey="50376" VRelease="2" />
+		<VMSinfo VKey="38575" SVKey="50376" VRelease="3" />
 		<title>The audit system must be configured to audit user deletions of files and programs.</title>
 	</overlay>
 	<overlay owner="disastig" ruleid="audit_sysadmin_actions" ownerid="RHEL-06-000201" disa="172" severity="low">
diff --git a/RHEL/6/input/system/auditing.xml b/RHEL/6/input/system/auditing.xml
index e25f890..6c9f696 100644
--- a/RHEL/6/input/system/auditing.xml
+++ b/RHEL/6/input/system/auditing.xml
@@ -1210,7 +1210,9 @@ appropriate for your system:
 </description>
 <ocil>
 <audit-syscall-check-macro syscall="unlink" />
+<audit-syscall-check-macro syscall="unlinkat" />
 <audit-syscall-check-macro syscall="rename" />
+<audit-syscall-check-macro syscall="renameat" />
 </ocil>
 <rationale>Auditing file deletions will create an audit trail for files that are removed
 from the system. The audit trail could aid in system troubleshooting, as well as, detecting
-- 
1.7.1



More information about the scap-security-guide mailing list