<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <br>
    <div class="moz-cite-prefix">On 7/27/14, 11:26 PM, Shawn Wells
      wrote:<br>
    </div>
    <blockquote
      cite="mid:1406518028-3921-11-git-send-email-shawn@redhat.com"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-unicode">
        <pre wrap="">From: Leland Steinke <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:leland.j.steinke.ctr@mail.mil">&lt;leland.j.steinke.ctr@mail.mil&gt;</a>

- Update VRelease key
- Add OCIL for unlinkat, renameat
- Update grep regex from 'grep' to 'grep -w'

Signed-off-by: Leland Steinke <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:leland.j.steinke.ctr@mail.mil">&lt;leland.j.steinke.ctr@mail.mil&gt;</a>
---
 RHEL/6/input/auxiliary/stig_overlay.xml |    2 +-
 RHEL/6/input/system/auditing.xml        |    2 ++
 2 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/RHEL/6/input/auxiliary/stig_overlay.xml b/RHEL/6/input/auxiliary/stig_overlay.xml
index 2e922d1..bc540d6 100644
--- a/RHEL/6/input/auxiliary/stig_overlay.xml
+++ b/RHEL/6/input/auxiliary/stig_overlay.xml
@@ -569,7 +569,7 @@
                 &lt;title&gt;The audit system must be configured to audit successful file system mounts.&lt;/title&gt;
         &lt;/overlay&gt;
         &lt;overlay owner="disastig" ruleid="audit_rules_file_deletion_events" ownerid="RHEL-06-000200" disa="172" severity="low"&gt;
-                &lt;VMSinfo VKey="38575" SVKey="50376" VRelease="2" /&gt;
+                &lt;VMSinfo VKey="38575" SVKey="50376" VRelease="3" /&gt;
                 &lt;title&gt;The audit system must be configured to audit user deletions of files and programs.&lt;/title&gt;
         &lt;/overlay&gt;
         &lt;overlay owner="disastig" ruleid="audit_sysadmin_actions" ownerid="RHEL-06-000201" disa="172" severity="low"&gt;
diff --git a/RHEL/6/input/system/auditing.xml b/RHEL/6/input/system/auditing.xml
index e25f890..6c9f696 100644
--- a/RHEL/6/input/system/auditing.xml
+++ b/RHEL/6/input/system/auditing.xml
@@ -1210,7 +1210,9 @@ appropriate for your system:
 &lt;/description&gt;
 &lt;ocil&gt;
 &lt;audit-syscall-check-macro syscall="unlink" /&gt;
+&lt;audit-syscall-check-macro syscall="unlinkat" /&gt;
 &lt;audit-syscall-check-macro syscall="rename" /&gt;
+&lt;audit-syscall-check-macro syscall="renameat" /&gt;
 &lt;/ocil&gt;
 &lt;rationale&gt;Auditing file deletions will create an audit trail for files that are removed
 from the system. The audit trail could aid in system troubleshooting, as well as, detecting
<div class="moz-txt-sig">-- 
1.7.1
</div></pre>
      </div>
    </blockquote>
    ack<br>
  </body>
</html>