[PATCH 10/21] Check syscall audits explicitly to avoid partial matches

Shawn Wells shawn at redhat.com
Mon Jul 28 03:36:38 UTC 2014


On 7/27/14, 11:26 PM, Shawn Wells wrote:
> From: Leland Steinke<leland.j.steinke.ctr at mail.mil>
>
> - Update VRelease key
> - Add OCIL for unlinkat, renameat
> - Update grep regex from 'grep' to 'grep -w'
>
> Signed-off-by: Leland Steinke<leland.j.steinke.ctr at mail.mil>
> ---
>   RHEL/6/input/auxiliary/stig_overlay.xml |    2 +-
>   RHEL/6/input/system/auditing.xml        |    2 ++
>   2 files changed, 3 insertions(+), 1 deletions(-)
>
> diff --git a/RHEL/6/input/auxiliary/stig_overlay.xml b/RHEL/6/input/auxiliary/stig_overlay.xml
> index 2e922d1..bc540d6 100644
> --- a/RHEL/6/input/auxiliary/stig_overlay.xml
> +++ b/RHEL/6/input/auxiliary/stig_overlay.xml
> @@ -569,7 +569,7 @@
>   		<title>The audit system must be configured to audit successful file system mounts.</title>
>   	</overlay>
>   	<overlay owner="disastig" ruleid="audit_rules_file_deletion_events" ownerid="RHEL-06-000200" disa="172" severity="low">
> -		<VMSinfo VKey="38575" SVKey="50376" VRelease="2" />
> +		<VMSinfo VKey="38575" SVKey="50376" VRelease="3" />
>   		<title>The audit system must be configured to audit user deletions of files and programs.</title>
>   	</overlay>
>   	<overlay owner="disastig" ruleid="audit_sysadmin_actions" ownerid="RHEL-06-000201" disa="172" severity="low">
> diff --git a/RHEL/6/input/system/auditing.xml b/RHEL/6/input/system/auditing.xml
> index e25f890..6c9f696 100644
> --- a/RHEL/6/input/system/auditing.xml
> +++ b/RHEL/6/input/system/auditing.xml
> @@ -1210,7 +1210,9 @@ appropriate for your system:
>   </description>
>   <ocil>
>   <audit-syscall-check-macro syscall="unlink" />
> +<audit-syscall-check-macro syscall="unlinkat" />
>   <audit-syscall-check-macro syscall="rename" />
> +<audit-syscall-check-macro syscall="renameat" />
>   </ocil>
>   <rationale>Auditing file deletions will create an audit trail for files that are removed
>   from the system. The audit trail could aid in system troubleshooting, as well as, detecting
> -- 1.7.1
ack
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140727/18c26d75/attachment.html>


More information about the scap-security-guide mailing list