[PATCH] typo in audit_rules_file_deletion_events description

Paul Tittle (Contractor) ptittle at cmf.nrl.navy.mil
Tue May 20 19:38:28 UTC 2014


On 5/20/14 3:35 PM, Shawn Wells wrote:
>
> On 5/20/14, 3:33 PM, Paul Tittle wrote:
>> ---
>>   RHEL/6/input/system/auditing.xml |    2 +-
>>   1 files changed, 1 insertions(+), 1 deletions(-)
>>
>> diff --git a/RHEL/6/input/system/auditing.xml 
>> b/RHEL/6/input/system/auditing.xml
>> index 3ac27e6..4b0af89 100644
>> --- a/RHEL/6/input/system/auditing.xml
>> +++ b/RHEL/6/input/system/auditing.xml
>> @@ -1206,7 +1206,7 @@ loss.</rationale>
>>   deletion events for all users and root. Add the following to
>>   <tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as
>>   appropriate for your system:
>> -<pre>-a always,exit -F arch=ARCH S rmdir -S unlink -S unlinkat -S 
>> rename -S renameat -F auid&gt;=500 -F auid!=4294967295 -k delete</pre>
>> +<pre>-a always,exit -F arch=ARCH -S rmdir -S unlink -S unlinkat -S 
>> rename -S renameat -F auid&gt;=500 -F auid!=4294967295 -k delete</pre>
>>   </description>
>>   <ocil>
>>   <audit-syscall-check-macro syscall="unlink" />
>
> ack
>
Thanks Shawn. Pushed.


More information about the scap-security-guide mailing list