diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_seunshare.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_seunshare.rule

new file mode 100644

index 0000000000..ce7a936545

--- /dev/null

+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_seunshare.rule

@@ -0,0 +1,40 @@

+documentation_complete: true

+

+prodtype: rhel7,fedora

+

+title: 'Record Any Attempts to Run seunshare'

+

+description: |-

+    At a minimum, the audit system should collect any execution attempt

+    of the <tt>seunshare</tt> command for all users and root. If the <tt>auditd</tt>

+    daemon is configured to use the <tt>augenrules</tt> program to read audit rules

+    during daemon startup (the default), add the following lines to a file with suffix

+    <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:

+    
-a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change

+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>

+    utility to read audit rules during daemon startup, add the following lines to

+    <tt>/etc/audit/audit.rules</tt> file:

+    
-a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change

+

+rationale: |-

+    Misuse of privileged functions, either intentionally or unintentionally by

+    authorized users, or by unauthorized external entities that have compromised system accounts,

+    is a serious and ongoing concern and can have significant adverse impacts on organizations.

+    Auditing the use of privileged functions is one way to detect such misuse and identify

+    the risk from insider and advanced persistent threast.

+    

+    Privileged programs are subject to escalation-of-privilege attacks,

+    which attempt to subvert their normal role of providing some necessary but

+    limited capability. As such, motivation exists to monitor these programs for

+    unusual activity.

+

+severity: medium

+

+references:

+    ospp@rhel7: FAU_GEN.1.1.c

+

+ocil: |-

+    To verify that execution of the command is being audited, run the following command:

+    
$ sudo grep "path=/usr/sbin/seunshare" /etc/audit/audit.rules /etc/audit/rules.d/*

+    The output should return something similar to:

+    
-a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change

diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_at.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_at.rule

new file mode 100644

index 0000000000..6d1a5c909b

--- /dev/null

+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_at.rule

@@ -0,0 +1,42 @@

+documentation_complete: true

+

+prodtype: rhel7,fedora

+

+title: 'Ensure auditd Collects Information on the Use of Privileged Commands - at'

+

+description: |-

+    At a minimum, the audit system should collect the execution of

+    privileged commands for all users and root. If the <tt>auditd</tt> daemon is

+    configured to use the <tt>augenrules</tt> program to read audit rules during

+    daemon startup (the default), add a line of the following form to a file with

+    suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:

+    
-a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>

+    utility to read audit rules during daemon startup, add a line of the following

+    form to <tt>/etc/audit/audit.rules</tt>:

+    
-a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

+

+rationale: |-

+    Misuse of privileged functions, either intentionally or unintentionally by

+    authorized users, or by unauthorized external entities that have compromised system accounts,

+    is a serious and ongoing concern and can have significant adverse impacts on organizations.

+    Auditing the use of privileged functions is one way to detect such misuse and identify

+    the risk from insider and advanced persistent threast.

+    

+    Privileged programs are subject to escalation-of-privilege attacks,

+    which attempt to subvert their normal role of providing some necessary but

+    limited capability. As such, motivation exists to monitor these programs for

+    unusual activity.

+

+severity: medium

+

+references:

+    ospp@rhel7: FAU_GEN.1.1.c

+

+ocil_clause: 'it is not the case'

+

+ocil: |-

+    To verify that auditing of privileged command use is configured, run the

+    following command:

+    
$ sudo grep '\bat\b' /etc/audit/audit.rules /etc/audit/rules.d/*

+    It should return a relevant line in the audit rules.

diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount.rule

new file mode 100644

index 0000000000..8eb3f39f01

--- /dev/null

+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount.rule

@@ -0,0 +1,42 @@

+documentation_complete: true

+

+prodtype: rhel7,fedora

+

+title: 'Ensure auditd Collects Information on the Use of Privileged Commands - mount'

+

+description: |-

+    At a minimum, the audit system should collect the execution of

+    privileged commands for all users and root. If the <tt>auditd</tt> daemon is

+    configured to use the <tt>augenrules</tt> program to read audit rules during

+    daemon startup (the default), add a line of the following form to a file with

+    suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:

+    
-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>

+    utility to read audit rules during daemon startup, add a line of the following

+    form to <tt>/etc/audit/audit.rules</tt>:

+    
-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

+

+rationale: |-

+    Misuse of privileged functions, either intentionally or unintentionally by

+    authorized users, or by unauthorized external entities that have compromised system accounts,

+    is a serious and ongoing concern and can have significant adverse impacts on organizations.

+    Auditing the use of privileged functions is one way to detect such misuse and identify

+    the risk from insider and advanced persistent threast.

+    

+    Privileged programs are subject to escalation-of-privilege attacks,

+    which attempt to subvert their normal role of providing some necessary but

+    limited capability. As such, motivation exists to monitor these programs for

+    unusual activity.

+

+severity: medium

+

+references:

+    ospp@rhel7: FAU_GEN.1.1.c

+

+ocil_clause: 'it is not the case'

+

+ocil: |-

+    To verify that auditing of privileged command use is configured, run the

+    following command:

+    
$ sudo grep mount /etc/audit/audit.rules /etc/audit/rules.d/*

+    It should return a relevant line in the audit rules.

diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgidmap.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgidmap.rule

new file mode 100644

index 0000000000..bd8dbcf1bd

--- /dev/null

+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgidmap.rule

@@ -0,0 +1,42 @@

+documentation_complete: true

+

+prodtype: rhel7,fedora

+

+title: 'Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap'

+

+description: |-

+    At a minimum, the audit system should collect the execution of

+    privileged commands for all users and root. If the <tt>auditd</tt> daemon is

+    configured to use the <tt>augenrules</tt> program to read audit rules during

+    daemon startup (the default), add a line of the following form to a file with

+    suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:

+    
-a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>

+    utility to read audit rules during daemon startup, add a line of the following

+    form to <tt>/etc/audit/audit.rules</tt>:

+    
-a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

+

+rationale: |-

+    Misuse of privileged functions, either intentionally or unintentionally by

+    authorized users, or by unauthorized external entities that have compromised system accounts,

+    is a serious and ongoing concern and can have significant adverse impacts on organizations.

+    Auditing the use of privileged functions is one way to detect such misuse and identify

+    the risk from insider and advanced persistent threast.

+    

+    Privileged programs are subject to escalation-of-privilege attacks,

+    which attempt to subvert their normal role of providing some necessary but

+    limited capability. As such, motivation exists to monitor these programs for

+    unusual activity.

+

+severity: medium

+

+references:

+    ospp@rhel7: FAU_GEN.1.1.c

+

+ocil_clause: 'it is not the case'

+

+ocil: |-

+    To verify that auditing of privileged command use is configured, run the

+    following command:

+    
$ sudo grep newgidmap /etc/audit/audit.rules /etc/audit/rules.d/*

+    It should return a relevant line in the audit rules.

diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newuidmap.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newuidmap.rule

new file mode 100644

index 0000000000..199dc381a1

--- /dev/null

+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newuidmap.rule

@@ -0,0 +1,42 @@

+documentation_complete: true

+

+prodtype: rhel7,fedora

+

+title: 'Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap'

+

+description: |-

+    At a minimum, the audit system should collect the execution of

+    privileged commands for all users and root. If the <tt>auditd</tt> daemon is

+    configured to use the <tt>augenrules</tt> program to read audit rules during

+    daemon startup (the default), add a line of the following form to a file with

+    suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:

+    
-a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>

+    utility to read audit rules during daemon startup, add a line of the following

+    form to <tt>/etc/audit/audit.rules</tt>:

+    
-a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

+

+rationale: |-

+    Misuse of privileged functions, either intentionally or unintentionally by

+    authorized users, or by unauthorized external entities that have compromised system accounts,

+    is a serious and ongoing concern and can have significant adverse impacts on organizations.

+    Auditing the use of privileged functions is one way to detect such misuse and identify

+    the risk from insider and advanced persistent threast.

+    

+    Privileged programs are subject to escalation-of-privilege attacks,

+    which attempt to subvert their normal role of providing some necessary but

+    limited capability. As such, motivation exists to monitor these programs for

+    unusual activity.

+

+severity: medium

+

+references:

+    ospp@rhel7: FAU_GEN.1.1.c

+

+ocil_clause: 'it is not the case'

+

+ocil: |-

+    To verify that auditing of privileged command use is configured, run the

+    following command:

+    
$ sudo grep newuidmap /etc/audit/audit.rules /etc/audit/rules.d/*

+    It should return a relevant line in the audit rules.

diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_usernetctl.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_usernetctl.rule

new file mode 100644

index 0000000000..c574f82d25

--- /dev/null

+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_usernetctl.rule

@@ -0,0 +1,42 @@

+documentation_complete: true

+

+prodtype: rhel7,fedora

+

+title: 'Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl'

+

+description: |-

+    At a minimum, the audit system should collect the execution of

+    privileged commands for all users and root. If the <tt>auditd</tt> daemon is

+    configured to use the <tt>augenrules</tt> program to read audit rules during

+    daemon startup (the default), add a line of the following form to a file with

+    suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:

+    
-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>

+    utility to read audit rules during daemon startup, add a line of the following

+    form to <tt>/etc/audit/audit.rules</tt>:

+    
-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

+

+rationale: |-

+    Misuse of privileged functions, either intentionally or unintentionally by

+    authorized users, or by unauthorized external entities that have compromised system accounts,

+    is a serious and ongoing concern and can have significant adverse impacts on organizations.

+    Auditing the use of privileged functions is one way to detect such misuse and identify

+    the risk from insider and advanced persistent threast.

+    

+    Privileged programs are subject to escalation-of-privilege attacks,

+    which attempt to subvert their normal role of providing some necessary but

+    limited capability. As such, motivation exists to monitor these programs for

+    unusual activity.

+

+severity: medium

+

+references:

+    ospp@rhel7: FAU_GEN.1.1.c

+

+ocil_clause: 'it is not the case'

+

+ocil: |-

+    To verify that auditing of privileged command use is configured, run the

+    following command:

+    
$ sudo grep usernetctl /etc/audit/audit.rules /etc/audit/rules.d/*

+    It should return a relevant line in the audit rules.

diff --git a/rhel7/profiles/ospp42-draft.profile b/rhel7/profiles/ospp42-draft.profile

index 9802576814..270a94f85f 100644

--- a/rhel7/profiles/ospp42-draft.profile

+++ b/rhel7/profiles/ospp42-draft.profile

@@ -121,6 +121,7 @@ selections:

     - audit_rules_execution_restorecon

     - audit_rules_execution_semanage

     - audit_rules_execution_setsebool

+    - audit_rules_execution_seunshare

     - audit_rules_mac_modification

     - audit_rules_dac_modification_chown

     - audit_rules_unsuccessful_file_modification_chown

@@ -130,15 +131,20 @@ selections:

     - audit_rules_unsuccessful_file_modification_fchown

     - audit_rules_dac_modification_lchown

     - audit_rules_unsuccessful_file_modification_lchown

+    - audit_rules_privileged_commands_at

+    - audit_rules_privileged_commands_mount

     - audit_rules_privileged_commands_passwd

     - audit_rules_privileged_commands_unix_chkpwd

     - audit_rules_privileged_commands_userhelper

+    - audit_rules_privileged_commands_usernetctl

     - audit_rules_privileged_commands_chage

     - audit_rules_privileged_commands_chsh

     - audit_rules_privileged_commands_pt_chown

     - audit_rules_sysadmin_actions

     - audit_rules_privileged_commands_gpasswd

+    - audit_rules_privileged_commands_newgidmap

     - audit_rules_privileged_commands_newgrp

+    - audit_rules_privileged_commands_newuidmap

     - audit_rules_usergroup_modification_group

     - audit_rules_usergroup_modification_gshadow

     - audit_rules_usergroup_modification_opasswd

diff --git a/shared/bash_remediation_functions/perform_audit_rules_privileged_commands_remediation.sh b/shared/bash_remediation_functions/perform_audit_rules_privileged_commands_remediation.sh

index 73a08dd98a..3fd55c84d4 100644

--- a/shared/bash_remediation_functions/perform_audit_rules_privileged_commands_remediation.sh

+++ b/shared/bash_remediation_functions/perform_audit_rules_privileged_commands_remediation.sh

@@ -79,7 +79,7 @@ do

 	local count_of_inspected_files=0

 	# Define expected rule form for this binary

-	expected_rule="-a always,exit -F path=${sbinary} -F perm=x -F auid>=${min_auid} -F auid!=4294967295 -k privileged"

+	expected_rule="-a always,exit -F path=${sbinary} -F perm=x -F auid>=${min_auid} -F auid!=unset -k privileged"

 	# If list of audit rules files to be inspected is empty, just add new rule and move on to next binary

 	if [[ ${#files_to_inspect[@]} -eq 0 ]]; then

@@ -100,9 +100,9 @@ do

 		# * existing rule contains all arguments from expected rule form (though can contain

 		#   them in arbitrary order)

-		base_search=$(sed -e '/-a always,exit/!d' -e '/-F path='"${sbinary_esc}"'/!d' \

-				-e '/-F path=[^[:space:]]\+/!d'   -e '/-F perm=.*/!d'                 \

-				-e '/-F auid>='"${min_auid}"'/!d' -e '/-F auid!=4294967295/!d'        \

+		base_search=$(sed -e '/-a always,exit/!d' -e '/-F path='"${sbinary_esc}"'/!d'		\

+				-e '/-F path=[^[:space:]]\+/!d'   -e '/-F perm=.*/!d'						\

+				-e '/-F auid>='"${min_auid}"'/!d' -e '/-F auid!=\(?:4294967295\|unset\)/!d'	\

 				-e '/-k privileged/!d' "$afile")

 		# Increase the count of inspected files for this sbinary

diff --git a/shared/templates/csv/audit_rules_execution.csv b/shared/templates/csv/audit_rules_execution.csv

index 8a78a4323c..45aa7493f3 100644

--- a/shared/templates/csv/audit_rules_execution.csv

+++ b/shared/templates/csv/audit_rules_execution.csv

@@ -3,3 +3,4 @@

 /usr/sbin/semanage

 /usr/sbin/setfiles

 /usr/sbin/setsebool

+/usr/sbin/seunshare

diff --git a/shared/templates/csv/audit_rules_privileged_commands.csv b/shared/templates/csv/audit_rules_privileged_commands.csv

index 2d45332344..7fa26ffe2d 100644

--- a/shared/templates/csv/audit_rules_privileged_commands.csv

+++ b/shared/templates/csv/audit_rules_privileged_commands.csv

@@ -1,8 +1,12 @@

+/usr/bin/at

 /usr/bin/chage

 /usr/bin/chsh

 /usr/bin/crontab

 /usr/bin/gpasswd

+/usr/bin/mount

+/usr/bin/newgidmap

 /usr/bin/newgrp

+/usr/bin/newuidmap

 /usr/sbin/pam_timestamp_check

 /usr/bin/passwd

 /usr/sbin/postdrop

@@ -15,3 +19,4 @@

 /usr/bin/umount

 /usr/sbin/unix_chkpwd

 /usr/sbin/userhelper

+/usr/sbin/usernetctl

diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/generate_privileged_commands_rule.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/generate_privileged_commands_rule.sh

new file mode 100755

index 0000000000..9dc0cd1ce2

--- /dev/null

+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/generate_privileged_commands_rule.sh

@@ -0,0 +1,8 @@

+#!/bin/bash

+

+AUID=$1

+KEY=$2

+RULEPATH=$3

+for file in $(find / -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null); do

+     echo "-a always,exit -F path=$file -F perm=x -F auid>=$AUID -F auid!=unset -k $KEY" >> $RULEPATH

+done

diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_audit.rules b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_audit.rules

deleted file mode 100644

index 703bbafe10..0000000000

--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_audit.rules

+++ /dev/null

@@ -1,37 +0,0 @@

--a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/at -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/wall -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/write -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/ksu -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/locate -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/pkexec -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/libexec/polkit-1/polkit-agent-helper-1 -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/libexec/pt_chown -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/libexec/utempter/utempter -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/sbin/netreport -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/sbin/pam_timestamp_check -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/lib64/dbus-1/dbus-daemon-launch-helper -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/bin/mount -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/bin/su -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/bin/umount -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/bin/cgclassify -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/bin/cgexec -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

--a always,exit -F path=/bin/ping6 -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_auditctl_rules_configured.pass.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_auditctl_rules_configured.pass.sh

index 60b9eb0c45..a8a25ebdb3 100644

--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_auditctl_rules_configured.pass.sh

+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_auditctl_rules_configured.pass.sh

@@ -2,7 +2,6 @@

 # profiles = xccdf_org.ssgproject.content_profile_pci-dss

 # remediation = bash

-cp rhel6_audit.rules /etc/audit/rules.d/privileged.rules

-cp rhel6_audit.rules /etc/audit/audit.rules

+./generate_privileged_commands_rule.sh 500 privileged /etc/audit/audit.rules

 # This is a trick to fail setup of this test in rhel7 systems

 ls /etc/sysconfig/auditd

diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_augenrules_rules_configured.pass.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_augenrules_rules_configured.pass.sh

index 1b628be506..5594d7566a 100644

--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_augenrules_rules_configured.pass.sh

+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_augenrules_rules_configured.pass.sh

@@ -2,6 +2,5 @@

 # profiles = xccdf_org.ssgproject.content_profile_pci-dss

 # remediation = bash

-cp rhel6_audit.rules /etc/audit/rules.d/privileged.rules

-cp rhel6_audit.rules /etc/audit/audit.rules

+./generate_privileged_commands_rule.sh 500 privileged /etc/audit/rules.d/privileged.rules

 sed -i "s/USE_AUGENRULES=.*/USE_AUGENRULES=\"yes\"/" /etc/sysconfig/auditd

diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_auditctl_rules_configured.pass.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_auditctl_rules_configured.pass.sh

index ee95d13d5d..3f891eed60 100644

--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_auditctl_rules_configured.pass.sh

+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_auditctl_rules_configured.pass.sh

@@ -2,6 +2,5 @@

 # profiles = xccdf_org.ssgproject.content_profile_pci-dss

 # remediation = bash

-cp rhel7_privileged.rules /etc/audit/rules.d/privileged.rules

-cp rhel7_privileged.rules /etc/audit/audit.rules

+./generate_privileged_commands_rule.sh 1000 privileged /etc/audit/audit.rules

 sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service

diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_augenrules_rules_configured.pass.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_augenrules_rules_configured.pass.sh

index 77f9549418..74583bf989 100644

--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_augenrules_rules_configured.pass.sh

+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_augenrules_rules_configured.pass.sh

@@ -2,7 +2,6 @@

 # profiles = xccdf_org.ssgproject.content_profile_pci-dss

 # remediation = bash

-cp rhel7_privileged.rules /etc/audit/rules.d/privileged.rules

-cp rhel7_privileged.rules /etc/audit/audit.rules

+./generate_privileged_commands_rule.sh 1000 privileged /etc/audit/rules.d/privileged.rules

 # This is a trick to fail setup of this test in rhel6 systems

 ls /usr/lib/systemd/system/auditd.service

diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_own_key.rules b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_own_key.rules

deleted file mode 100644

index 4df6d4ec8b..0000000000

--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_own_key.rules

+++ /dev/null

@@ -1,30 +0,0 @@

--a always,exit -F path=/usr/bin/wall -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/bin/write -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/bin/pkexec -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/bin/locate -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/sbin/netreport -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/lib/polkit-1/polkit-agent-helper-1 -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/libexec/utempter/utempter -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/libexec/dbus-1/dbus-daemon-launch-helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

--a always,exit -F path=/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key

diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_privileged.rules b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_privileged.rules

deleted file mode 100644

index 4eb644acbc..0000000000

--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_privileged.rules

+++ /dev/null

@@ -1,30 +0,0 @@

--a always,exit -F path=/usr/bin/wall -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/write -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/pkexec -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/bin/locate -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/sbin/netreport -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/lib/polkit-1/polkit-agent-helper-1 -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/libexec/utempter/utempter -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/libexec/dbus-1/dbus-daemon-launch-helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

--a always,exit -F path=/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_rules_with_own_key.pass.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_rules_with_own_key.pass.sh

index ac5ef2ddd9..35a5fde2c6 100644

--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_rules_with_own_key.pass.sh

+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_rules_with_own_key.pass.sh

@@ -2,7 +2,6 @@

 # profiles = xccdf_org.ssgproject.content_profile_pci-dss

 # remediation = bash

-cp rhel7_own_key.rules /etc/audit/rules.d/privileged.rules

-cp rhel7_own_key.rules /etc/audit/audit.rules

+./generate_privileged_commands_rule.sh 1000 own_key /etc/audit/rules.d/privileged.rules

 # This is a trick to fail setup of this test in rhel6 systems

 ls /usr/lib/systemd/system/auditd.service