<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 7/19/13 2:53 PM, Shawn Wells wrote:<br>
    </div>
    <blockquote cite="mid:51E98B41.5010702@redhat.com" type="cite">
      <div class="moz-cite-prefix">On 7/19/13 1:47 PM, Andrew Gilmore
        wrote:<br>
      </div>
      <blockquote
        cite="mid:1374256027-25461-2-git-send-email-agilmore2@gmail.com"
        type="cite">
        <div class="moz-text-plain" wrap="true" graphical-quote="true"
          style="font-family: -moz-fixed; font-size: 12px;"
          lang="x-unicode">
          <pre wrap="">---
 .../audit_rules_networkconfig_modification.xml     |    2 +-
 RHEL6/input/system/auditing.xml                    |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/RHEL6/input/checks/audit_rules_networkconfig_modification.xml b/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
index be2c90f..e2fee0e 100644
--- a/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
+++ b/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
@@ -33,7 +33,7 @@
   &lt;/ind:textfilecontent54_test&gt;
   &lt;ind:textfilecontent54_object id="object_audit_rules_networkconfig_modification_syscall" version="1"&gt;
     &lt;ind:filepath&gt;/etc/audit/audit.rules&lt;/ind:filepath&gt;
-    &lt;ind:pattern operation="pattern match"&gt;^\-a\s+exit,always\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+sethostname\s+\-S\s+setdomainname\s+\-k\s+[-\w]+\s*$&lt;/ind:pattern&gt;
+    &lt;ind:pattern operation="pattern match"&gt;^\-a\s+(always,exit|exit,always)\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+sethostname\s+\-S\s+setdomainname\s+\-k\s+[-\w]+\s*$&lt;/ind:pattern&gt;</pre>
        </div>
      </blockquote>
    </blockquote>
    <br>
    Was filing this EMail away, then noticed you switched up that regex
    between this and the first patch ;)<br>
    <br>
    The -a option calls for an action of the syscall, then the list to
    append to. Valid actions are always and never, so this should really
    be:<br>
    <br>
    <pre wrap="">^\-a\s+always,exit\s+(....

</pre>
    Ref "System Call" section of manpage @
    <a class="moz-txt-link-freetext" href="http://linux.die.net/man/7/audit.rules">http://linux.die.net/man/7/audit.rules</a><br>
    <br>
    Please revert.<br>
    <br>
    <br>
    <blockquote cite="mid:51E98B41.5010702@redhat.com" type="cite">
      <blockquote
        cite="mid:1374256027-25461-2-git-send-email-agilmore2@gmail.com"
        type="cite">
        <div class="moz-text-plain" wrap="true" graphical-quote="true"
          style="font-family: -moz-fixed; font-size: 12px;"
          lang="x-unicode">
          <pre wrap="">
     &lt;ind:instance datatype="int"&gt;1&lt;/ind:instance&gt;
   &lt;/ind:textfilecontent54_object&gt;
   &lt;ind:textfilecontent54_object id="object_audit_rules_networkconfig_modification_etc_issue" version="1"&gt;
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index b1768ee..4597b6f 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -662,7 +662,7 @@ legitimacy.&lt;/rationale&gt;
 &lt;description&gt;Add the following to &lt;tt&gt;/etc/audit/audit.rules&lt;/tt&gt;, setting
 ARCH to either b32 or b64 as appropriate for your system:
 &lt;pre&gt;# audit_network_modifications
--a exit,always -F arch=ARCH -S sethostname -S setdomainname -k audit_network_modifications
+-a always,exit -F arch=ARCH -S sethostname -S setdomainname -k audit_network_modifications
 -w /etc/issue -p wa -k audit_network_modifications
 -w /etc/issue.net -p wa -k audit_network_modifications
 -w /etc/hosts -p wa -k audit_network_modifications
<div class="moz-txt-sig">-- 
1.7.1
</div></pre>
        </div>
      </blockquote>
      <br>
      Ack - thanks for updating the xccdf</blockquote>
    <br>
    <br>
    <pre class="moz-signature" cols="72">-- 
Shawn Wells
Director, Innovation Programs
<a class="moz-txt-link-abbreviated" href="mailto:shawn@redhat.com">shawn@redhat.com</a> | 443.534.0130
@shawndwells</pre>
  </body>
</html>