[PATCH 4/7] XCCDF rule name audit_file_access --> audit_rules_unsuccessful_file_modification

Shawn Wells shawn at redhat.com
Fri May 23 23:00:43 UTC 2014


To be consistent with other rule names

Signed-off-by: Shawn Wells <shawn at redhat.com>
---
 RHEL/6/input/auxiliary/stig_overlay.xml            |    2 +-
 RHEL/6/input/auxiliary/transition_notes.xml        |    8 ++++----
 RHEL/6/input/profiles/C2S.xml                      |    2 +-
 RHEL/6/input/profiles/CS2.xml                      |    2 +-
 RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml           |    2 +-
 RHEL/6/input/profiles/common.xml                   |    2 +-
 .../6/input/profiles/fisma-medium-rhel6-server.xml |    2 +-
 RHEL/6/input/profiles/nist-CL-IL-AL.xml            |    2 +-
 RHEL/6/input/profiles/usgcb-rhel6-server.xml       |    2 +-
 RHEL/6/input/system/auditing.xml                   |    2 +-
 10 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/RHEL/6/input/auxiliary/stig_overlay.xml b/RHEL/6/input/auxiliary/stig_overlay.xml
index 460a5bd..5465ef0 100644
--- a/RHEL/6/input/auxiliary/stig_overlay.xml
+++ b/RHEL/6/input/auxiliary/stig_overlay.xml
@@ -548,7 +548,7 @@
 		<VMSinfo VKey="38565" SVKey="50366" VRelease="2" />
 		<title>The audit system must be configured to audit all discretionary access control permission modifications using setxattr.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="audit_file_access" ownerid="RHEL-06-000197" disa="172" severity="low">
+	<overlay owner="disastig" ruleid="audit_rules_unsuccessful_file_modification" ownerid="RHEL-06-000197" disa="172" severity="low">
 		<VMSinfo VKey="38566" SVKey="50367" VRelease="2" />
 		<title>The audit system must be configured to audit failed attempts to access files and programs.</title>
 	</overlay>
diff --git a/RHEL/6/input/auxiliary/transition_notes.xml b/RHEL/6/input/auxiliary/transition_notes.xml
index 77f8a5f..c1b1870 100644
--- a/RHEL/6/input/auxiliary/transition_notes.xml
+++ b/RHEL/6/input/auxiliary/transition_notes.xml
@@ -53,10 +53,10 @@
 
 <note ref="29240" auth="GG" rule="audit_rules_file_deletion_events">This is covered in RHEL 6 content</note>
 
-<note ref="29239" auth="GG" rule="audit_file_access">This is covered in RHEL 6 content</note>
-<note ref="29238" auth="GG" rule="audit_file_access">This is covered in RHEL 6 content</note>
+<note ref="29239" auth="GG" rule="audit_rules_unsuccessful_file_modification">This is covered in RHEL 6 content</note>
+<note ref="29238" auth="GG" rule="audit_rules_unsuccessful_file_modification">This is covered in RHEL 6 content</note>
 <note ref="29237" auth="GG" rule="">This is not covered in RHEL 6 content</note>
-<note ref="29236" auth="GG" rule="audit_file_access">This is covered in RHEL 6 content</note>
+<note ref="29236" auth="GG" rule="audit_rules_unsuccessful_file_modification">This is covered in RHEL 6 content</note>
 
 <note ref="931" auth="VP">
 This is not in the RHEL 6 content.  Nosuid / nodev checks address perms on NFS shares.
@@ -1053,7 +1053,7 @@ also watch for LD_AUDIT
 <note ref="814" auth="KS">
 Check exists in the RHEL6 prose, it can be automated and the OVAL for it 
 appears to already exist. 
-rule=audit_file_access manual=no
+rule=audit_rules_unsuccessful_file_modification manual=no
 </note>
 
 <note ref="815" auth="KS">
diff --git a/RHEL/6/input/profiles/C2S.xml b/RHEL/6/input/profiles/C2S.xml
index bed6ee4..282da6a 100644
--- a/RHEL/6/input/profiles/C2S.xml
+++ b/RHEL/6/input/profiles/C2S.xml
@@ -443,7 +443,7 @@ Patches would be most welcome!
 <select idref="audit_dac_actions" selected="true" />
 
 <!-- 5.2.11 Collect Unsuccessful Unauthorized Access Attempts to Files (Scored) -->
-<select idref="audit_file_access" selected="true" />
+<select idref="audit_rules_unsuccessful_file_modification" selected="true" />
 
 <!-- 5.2.12 Collect Use of Privileged Commands (Scored) -->
 <select idref="audit_privileged_commands" selected="true" />
diff --git a/RHEL/6/input/profiles/CS2.xml b/RHEL/6/input/profiles/CS2.xml
index e8083f6..d530657 100644
--- a/RHEL/6/input/profiles/CS2.xml
+++ b/RHEL/6/input/profiles/CS2.xml
@@ -140,7 +140,7 @@
 <select idref="audit_logs_rootowner" selected="true" />
 <select idref="audit_manual_logon_edits" selected="true" />
 <select idref="audit_manual_session_edits" selected="true" />
-<select idref="audit_file_access" selected="true"/>
+<select idref="audit_rules_unsuccessful_file_modification" selected="true"/>
 <select idref="audit_privileged_commands" selected="true"/>
 <select idref="audit_media_exports" selected="true"/>
 <select idref="audit_rules_file_deletion_events" selected="true"/>
diff --git a/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml b/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml
index 7b306ee..4757cf6 100644
--- a/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml
+++ b/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml
@@ -19,7 +19,7 @@ for production deployment.</description>
 <select idref="aide_periodic_cron_checking" selected="true" />
 <select idref="audit_account_changes" selected="true" />
 <select idref="audit_config_immutable" selected="true" />
-<select idref="audit_file_access" selected="true" />
+<select idref="audit_rules_unsuccessful_file_modification" selected="true" />
 <select idref="audit_rules_file_deletion_events" selected="true" />
 <select idref="audit_kernel_module_loading" selected="true" />
 <select idref="file_permissions_var_log_audit" selected="true" />
diff --git a/RHEL/6/input/profiles/common.xml b/RHEL/6/input/profiles/common.xml
index 6d25b48..ba46588 100644
--- a/RHEL/6/input/profiles/common.xml
+++ b/RHEL/6/input/profiles/common.xml
@@ -141,7 +141,7 @@
 <select idref="audit_rules_dac_modification_removexattr" selected="true"/>
 <select idref="audit_rules_dac_modification_setxattr" selected="true"/>
 
-<select idref="audit_file_access" selected="true"/>
+<select idref="audit_rules_unsuccessful_file_modification" selected="true"/>
 <select idref="audit_privileged_commands" selected="true"/>
 <select idref="audit_media_exports" selected="true"/>
 <select idref="audit_rules_file_deletion_events" selected="true"/>
diff --git a/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml
index 05c687c..a1c4036 100644
--- a/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml
@@ -130,7 +130,7 @@
 <select idref="audit_rules_dac_modification_setxattr" selected="true" />
 <select idref="audit_manual_logon_edits" selected="true" />
 <select idref="audit_manual_session_edits" selected="true" />
-<select idref="audit_file_access" selected="true" />
+<select idref="audit_rules_unsuccessful_file_modification" selected="true" />
 <select idref="audit_privileged_commands" selected="true" />
 <select idref="audit_media_exports" selected="true" />
 <select idref="audit_rules_file_deletion_events" selected="true" />
diff --git a/RHEL/6/input/profiles/nist-CL-IL-AL.xml b/RHEL/6/input/profiles/nist-CL-IL-AL.xml
index 2d1135c..fd2087e 100644
--- a/RHEL/6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL/6/input/profiles/nist-CL-IL-AL.xml
@@ -215,7 +215,7 @@ assurance."</description>
 <select idref="audit_rules_dac_modification_setxattr" selected="true" \>
 <select idref="audit_manual_logon_edits" selected="true" \>
 <select idref="audit_manual_session_edits" selected="true" \>
-<select idref="audit_file_access" selected="true" \>
+<select idref="audit_rules_unsuccessful_file_modification" selected="true" \>
 <select idref="audit_privileged_commands" selected="true" \>
 <select idref="audit_media_exports" selected="true" \>
 <select idref="audit_rules_file_deletion_events" selected="true" \>
diff --git a/RHEL/6/input/profiles/usgcb-rhel6-server.xml b/RHEL/6/input/profiles/usgcb-rhel6-server.xml
index 1ab8ce5..7fa82c7 100644
--- a/RHEL/6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL/6/input/profiles/usgcb-rhel6-server.xml
@@ -187,7 +187,7 @@
 <select idref="audit_rules_dac_modification_lsetxattr" selected="true" />
 <select idref="audit_rules_dac_modification_removexattr" selected="true" />
 <select idref="audit_rules_dac_modification_setxattr" selected="true" />
-<select idref="audit_file_access" selected="true" />
+<select idref="audit_rules_unsuccessful_file_modification" selected="true" />
 <select idref="audit_privileged_commands" selected="true" />
 <select idref="audit_media_exports" selected="true" />
 <select idref="audit_rules_file_deletion_events" selected="true" />
diff --git a/RHEL/6/input/system/auditing.xml b/RHEL/6/input/system/auditing.xml
index 4b0af89..39196ec 100644
--- a/RHEL/6/input/system/auditing.xml
+++ b/RHEL/6/input/system/auditing.xml
@@ -1128,7 +1128,7 @@ as an attacker attempting to remove evidence of an intrusion.</rationale>
 <ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
 </Rule>
 
-<Rule id="audit_file_access">
+<Rule id="audit_rules_unsuccessful_file_modification">
 <title>Ensure <tt>auditd</tt> Collects Unauthorized Access Attempts to Files (unsuccessful)</title>
 <description>At a minimum the audit system should collect
 unauthorized file accesses for all users and root. Add the following
-- 
1.7.1



More information about the scap-security-guide mailing list