<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 7/19/13 1:47 PM, Andrew Gilmore
wrote:<br>
</div>
<blockquote
cite="mid:1374256027-25461-2-git-send-email-agilmore2@gmail.com"
type="cite">
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-unicode">
<pre wrap="">---
.../audit_rules_networkconfig_modification.xml | 2 +-
RHEL6/input/system/auditing.xml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/checks/audit_rules_networkconfig_modification.xml b/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
index be2c90f..e2fee0e 100644
--- a/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
+++ b/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
@@ -33,7 +33,7 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_audit_rules_networkconfig_modification_syscall" version="1">
<ind:filepath>/etc/audit/audit.rules</ind:filepath>
- <ind:pattern operation="pattern match">^\-a\s+exit,always\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+sethostname\s+\-S\s+setdomainname\s+\-k\s+[-\w]+\s*$</ind:pattern>
+ <ind:pattern operation="pattern match">^\-a\s+(always,exit|exit,always)\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+sethostname\s+\-S\s+setdomainname\s+\-k\s+[-\w]+\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_object id="object_audit_rules_networkconfig_modification_etc_issue" version="1">
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index b1768ee..4597b6f 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -662,7 +662,7 @@ legitimacy.</rationale>
<description>Add the following to <tt>/etc/audit/audit.rules</tt>, setting
ARCH to either b32 or b64 as appropriate for your system:
<pre># audit_network_modifications
--a exit,always -F arch=ARCH -S sethostname -S setdomainname -k audit_network_modifications
+-a always,exit -F arch=ARCH -S sethostname -S setdomainname -k audit_network_modifications
-w /etc/issue -p wa -k audit_network_modifications
-w /etc/issue.net -p wa -k audit_network_modifications
-w /etc/hosts -p wa -k audit_network_modifications
<div class="moz-txt-sig">--
1.7.1
</div></pre>
</div>
</blockquote>
<br>
Ack - thanks for updating the xccdf<br>
</body>
</html>