Closed gregelin closed 9 years ago
Further testing shows that audit control line for both 32 bit and 64 bit must be in place for the audit test to past.
This will fail in /etc/audit/audit.rules
:
-a always,exit -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod
#-a always,exit -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod
This will fail in /etc/audit/audit.rules
:
#-a always,exit -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod
This passes in /etc/audit/audit.rules
:
-a always,exit -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod
Thanks to @djk29a, for explaining that both arch 32 and 64 need to be included in audit file because it is not possible to know if the computer will be booted in 64 or 32 bit mode or for which architecture a binary is compiled. Updated template audit.rules-rhel6 file with controls for 32 and 64.
Closed 74944d530d26afb8a0d405246db92684aeb8c73f and commit e3f51f0a219695ae511f3ef2f258c60a563c4ed5
The only difference between to the below two oscap evaluations is the inclusion of the audit rule for 32bit architecture in the audit rules when the second evaluation is run.