|
 |
ff1465 |
commit 3064c4bc94047b1ca4c91db6008ded0694121563
|
|
|
ff1465 |
Author: Watson Sato <wsato@redhat.com>
|
|
|
ff1465 |
Date: Mon Feb 28 10:57:59 2022 +0100
|
|
|
ff1465 |
|
|
|
ff1465 |
Manual edited patch scap-security-guide-0.1.61-rhel8_stig_audit_rules-PR_8174.patch.
|
|
|
ff1465 |
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml
|
|
|
ff1465 |
index 6c3cc55..9208a17 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml
|
|
|
ff1465 |
@@ -55,7 +55,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000466-GPOS-00210,SRG-OS-000458-GPOS-00203
|
|
|
ff1465 |
stigid@ol7: OL07-00-030420
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030420
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030540
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030490
|
|
|
ff1465 |
stigid@sle12: SLES-12-020470
|
|
|
ff1465 |
stigid@sle15: SLES-15-030300
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010153
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml
|
|
|
ff1465 |
index 3e51d48..595824c 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml
|
|
|
ff1465 |
@@ -55,7 +55,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000466-GPOS-00210,SRG-OS-000458-GPOS-00203
|
|
|
ff1465 |
stigid@ol7: OL07-00-030430
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030430
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030530
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030490
|
|
|
ff1465 |
stigid@sle12: SLES-12-020480
|
|
|
ff1465 |
stigid@sle15: SLES-12-030310
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010154
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml
|
|
|
ff1465 |
index d89875f..470a995 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml
|
|
|
ff1465 |
@@ -58,7 +58,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000466-GPOS-00210,SRG-OS-000458-GPOS-00203,SRG-OS-000474-GPOS-00219
|
|
|
ff1465 |
stigid@ol7: OL07-00-030380
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030380
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030520
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030480
|
|
|
ff1465 |
stigid@sle12: SLES-12-020430
|
|
|
ff1465 |
stigid@sle15: SLES-15-030260
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010149
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml
|
|
|
ff1465 |
index e6caaeb..4db008f 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml
|
|
|
ff1465 |
@@ -55,7 +55,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000466-GPOS-00210,SRG-OS-000458-GPOS-00203,SRG-OS-000474-GPOS-00219
|
|
|
ff1465 |
stigid@ol7: OL07-00-030400
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030400
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030510
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030480
|
|
|
ff1465 |
stigid@sle12: SLES-12-020450
|
|
|
ff1465 |
stigid@sle15: SLES-15-030280
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010150
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml
|
|
|
ff1465 |
index b9ad3c7..cd4b200 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml
|
|
|
ff1465 |
@@ -72,7 +72,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000458-GPOS-00203,SRG-OS-000462-GPOS-00206,SRG-OS-000463-GPOS-00207,SRG-OS-000471-GPOS-00215,SRG-OS-000474-GPOS-00219,SRG-OS-000466-GPOS-00210,SRG-OS-000064-GPOS-00033
|
|
|
ff1465 |
stigid@ol7: OL07-00-030480
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030480
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030240
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030200
|
|
|
ff1465 |
stigid@sle12: SLES-12-020410
|
|
|
ff1465 |
stigid@sle15: SLES-15-030210
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010147
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml
|
|
|
ff1465 |
index cedf05f..dc6ef7f 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml
|
|
|
ff1465 |
@@ -67,7 +67,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000458-GPOS-00203,SRG-OS-000462-GPOS-00206,SRG-OS-000463-GPOS-00207,SRG-OS-000468-GPOS-00212,SRG-OS-000471-GPOS-00215,SRG-OS-000474-GPOS-00219,SRG-OS-000064-GPOS-00033
|
|
|
ff1465 |
stigid@ol7: OL07-00-030450
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030450
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030230
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030200
|
|
|
ff1465 |
stigid@sle12: SLES-12-020380
|
|
|
ff1465 |
stigid@sle15: SLES-15-030230
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010144
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml
|
|
|
ff1465 |
index 190509c..e57e177 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml
|
|
|
ff1465 |
@@ -55,7 +55,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000466-GPOS-00210,SRG-OS-000458-GPOS-00203,SRG-OS-000474-GPOS-00219
|
|
|
ff1465 |
stigid@ol7: OL07-00-030390
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030390
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030500
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030480
|
|
|
ff1465 |
stigid@sle12: SLES-12-020440
|
|
|
ff1465 |
stigid@sle15: SLES-15-030270
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010151
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml
|
|
|
ff1465 |
index 3662262..52ee93a 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml
|
|
|
ff1465 |
@@ -66,7 +66,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000458-GPOS-00203,SRG-OS-000462-GPOS-00206,SRG-OS-000463-GPOS-00207,SRG-OS-000468-GPOS-00212,SRG-OS-000471-GPOS-00215,SRG-OS-000474-GPOS-00219,SRG-OS-000064-GPOS-00033
|
|
|
ff1465 |
stigid@ol7: OL07-00-030460
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030460
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030220
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030200
|
|
|
ff1465 |
stigid@sle15: SLES-15-030240
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010143
|
|
|
ff1465 |
vmmsrg: SRG-OS-000458-VMM-001810,SRG-OS-000474-VMM-001940
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml
|
|
|
ff1465 |
index ac9d349..c462eb7 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml
|
|
|
ff1465 |
@@ -71,7 +71,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000458-GPOS-00203,SRG-OS-000462-GPOS-00206,SRG-OS-000463-GPOS-00207,SRG-OS-000468-GPOS-00212,SRG-OS-000471-GPOS-00215,SRG-OS-000474-GPOS-00219,SRG-OS-000466-GPOS-00210,SRG-OS-000064-GPOS-00033
|
|
|
ff1465 |
stigid@ol7: OL07-00-030470
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030470
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030210
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030200
|
|
|
ff1465 |
stigid@sle12: SLES-12-020390
|
|
|
ff1465 |
stigid@sle15: SLES-15-030190
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010145
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml
|
|
|
ff1465 |
index b661a1f..23630ec 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml
|
|
|
ff1465 |
@@ -67,7 +67,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203
|
|
|
ff1465 |
stigid@ol7: OL07-00-030440
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030440
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030270
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030200
|
|
|
ff1465 |
stigid@sle12: SLES-12-020370
|
|
|
ff1465 |
stigid@sle15: SLES-15-030220
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010142
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml
|
|
|
ff1465 |
index 37620a3..0f25e93 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml
|
|
|
ff1465 |
@@ -48,7 +48,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-OS-000467-GPOS-00211,SRG-OS-000468-GPOS-00212
|
|
|
ff1465 |
stigid@ol7: OL07-00-030890
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030890
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030362
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030361
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010270
|
|
|
ff1465 |
vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890
|
|
|
ff1465 |
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml
|
|
|
ff1465 |
index e6b4004..7c5b3b0 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml
|
|
|
ff1465 |
@@ -47,7 +47,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-OS-000467-GPOS-00211,SRG-OS-000468-GPOS-00212
|
|
|
ff1465 |
stigid@ol7: OL07-00-030900
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030900
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030363
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030361
|
|
|
ff1465 |
vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890
|
|
|
ff1465 |
|
|
|
ff1465 |
{{{ complete_ocil_entry_audit_syscall(syscall="rmdir") }}}
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml
|
|
|
ff1465 |
index bfe53b7..209c622 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml
|
|
|
ff1465 |
@@ -48,7 +48,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-OS-000467-GPOS-00211,SRG-OS-000468-GPOS-00212
|
|
|
ff1465 |
stigid@ol7: OL07-00-030910
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030910
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030364
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030361
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010267
|
|
|
ff1465 |
vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890
|
|
|
ff1465 |
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml
|
|
|
ff1465 |
index bd246f1..56c644e 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml
|
|
|
ff1465 |
@@ -48,7 +48,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-OS-000467-GPOS-00211,SRG-OS-000468-GPOS-00212
|
|
|
ff1465 |
stigid@ol7: OL07-00-030920
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030920
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030365
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030361
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010268
|
|
|
ff1465 |
vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890
|
|
|
ff1465 |
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
|
|
|
ff1465 |
index 5c751cb..4516c7c 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
|
|
|
ff1465 |
@@ -60,7 +60,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205
|
|
|
ff1465 |
stigid@ol7: OL07-00-030500
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030500
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030470
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030420
|
|
|
ff1465 |
stigid@sle12: SLES-12-020520
|
|
|
ff1465 |
stigid@sle15: SLES-15-030160
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010158
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
|
|
|
ff1465 |
index 76bcea1..4a845c3 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
|
|
|
ff1465 |
@@ -63,7 +63,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205
|
|
|
ff1465 |
stigid@ol7: OL07-00-030550
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030550
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030460
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030420
|
|
|
ff1465 |
stigid@sle12: SLES-12-020510
|
|
|
ff1465 |
stigid@sle15: SLES-15-030320
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010157
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
|
|
|
ff1465 |
index 7c6764d..fc6cf35 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
|
|
|
ff1465 |
@@ -63,7 +63,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205
|
|
|
ff1465 |
stigid@ol7: OL07-00-030510
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030510
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030440
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030420
|
|
|
ff1465 |
stigid@sle12: SLES-12-020490
|
|
|
ff1465 |
stigid@sle15: SLES-15-030150
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010155
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml
|
|
|
ff1465 |
index 9bb5ffe..be08972 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml
|
|
|
ff1465 |
@@ -59,7 +59,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205
|
|
|
ff1465 |
stigid@ol7: OL07-00-030530
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030530
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030450
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030420
|
|
|
ff1465 |
stigid@sle12: SLES-12-020540
|
|
|
ff1465 |
stigid@sle15: SLES-15-030180
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010160
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
|
|
|
ff1465 |
index c99656c..63aa3f3 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
|
|
|
ff1465 |
@@ -63,7 +63,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205
|
|
|
ff1465 |
stigid@ol7: OL07-00-030520
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030520
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030430
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030420
|
|
|
ff1465 |
stigid@sle12: SLES-12-020530
|
|
|
ff1465 |
stigid@sle15: SLES-15-030170
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010159
|
|
|
ff1465 |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml
|
|
|
ff1465 |
index aa17002..62cc33d 100644
|
|
|
ff1465 |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml
|
|
|
ff1465 |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml
|
|
|
ff1465 |
@@ -50,7 +50,7 @@ references:
|
|
|
ff1465 |
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000471-GPOS-00216,SRG-OS-000477-GPOS-00222
|
|
|
ff1465 |
stigid@ol7: OL07-00-030821
|
|
|
ff1465 |
stigid@rhel7: RHEL-07-030821
|
|
|
ff1465 |
- stigid@rhel8: RHEL-08-030380
|
|
|
ff1465 |
+ stigid@rhel8: RHEL-08-030360
|
|
|
ff1465 |
stigid@sle12: SLES-12-020740
|
|
|
ff1465 |
stigid@sle15: SLES-15-030530
|
|
|
ff1465 |
stigid@ubuntu2004: UBTU-20-010180
|
|
|
ff1465 |
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
|
|
ff1465 |
index a641eee..5829039 100644
|
|
|
ff1465 |
--- a/products/rhel8/profiles/stig.profile
|
|
|
ff1465 |
+++ b/products/rhel8/profiles/stig.profile
|
|
|
ff1465 |
@@ -561,6 +561,8 @@ selections:
|
|
|
ff1465 |
|
|
|
ff1465 |
# RHEL-08-020220
|
|
|
ff1465 |
- accounts_password_pam_pwhistory_remember_system_auth
|
|
|
ff1465 |
+
|
|
|
ff1465 |
+ # RHEL-08-020221
|
|
|
ff1465 |
- accounts_password_pam_pwhistory_remember_password_auth
|
|
|
ff1465 |
|
|
|
ff1465 |
# RHEL-08-020230
|
|
|
ff1465 |
@@ -713,18 +715,11 @@ selections:
|
|
|
ff1465 |
|
|
|
ff1465 |
# RHEL-08-030200
|
|
|
ff1465 |
- audit_rules_dac_modification_lremovexattr
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030210
|
|
|
ff1465 |
- audit_rules_dac_modification_removexattr
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030220
|
|
|
ff1465 |
- audit_rules_dac_modification_lsetxattr
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030230
|
|
|
ff1465 |
- audit_rules_dac_modification_fsetxattr
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030240
|
|
|
ff1465 |
- audit_rules_dac_modification_fremovexattr
|
|
|
ff1465 |
+ - audit_rules_dac_modification_setxattr
|
|
|
ff1465 |
|
|
|
ff1465 |
# RHEL-08-030250
|
|
|
ff1465 |
- audit_rules_privileged_commands_chage
|
|
|
ff1465 |
@@ -732,8 +727,6 @@ selections:
|
|
|
ff1465 |
# RHEL-08-030260
|
|
|
ff1465 |
- audit_rules_execution_chcon
|
|
|
ff1465 |
|
|
|
ff1465 |
- # RHEL-08-030270
|
|
|
ff1465 |
- - audit_rules_dac_modification_setxattr
|
|
|
ff1465 |
|
|
|
ff1465 |
# RHEL-08-030280
|
|
|
ff1465 |
- audit_rules_privileged_commands_ssh_agent
|
|
|
ff1465 |
@@ -788,28 +781,18 @@ selections:
|
|
|
ff1465 |
|
|
|
ff1465 |
# RHEL-08-030360
|
|
|
ff1465 |
- audit_rules_kernel_module_loading_init
|
|
|
ff1465 |
+ - audit_rules_kernel_module_loading_finit
|
|
|
ff1465 |
|
|
|
ff1465 |
# RHEL-08-030361
|
|
|
ff1465 |
- audit_rules_file_deletion_events_rename
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030362
|
|
|
ff1465 |
- audit_rules_file_deletion_events_renameat
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030363
|
|
|
ff1465 |
- audit_rules_file_deletion_events_rmdir
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030364
|
|
|
ff1465 |
- audit_rules_file_deletion_events_unlink
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030365
|
|
|
ff1465 |
- audit_rules_file_deletion_events_unlinkat
|
|
|
ff1465 |
|
|
|
ff1465 |
# RHEL-08-030370
|
|
|
ff1465 |
- audit_rules_privileged_commands_gpasswd
|
|
|
ff1465 |
|
|
|
ff1465 |
- # RHEL-08-030380
|
|
|
ff1465 |
- - audit_rules_kernel_module_loading_finit
|
|
|
ff1465 |
-
|
|
|
ff1465 |
# RHEL-08-030390
|
|
|
ff1465 |
- audit_rules_kernel_module_loading_delete
|
|
|
ff1465 |
|
|
|
ff1465 |
@@ -821,41 +804,21 @@ selections:
|
|
|
ff1465 |
|
|
|
ff1465 |
# RHEL-08-030420
|
|
|
ff1465 |
- audit_rules_unsuccessful_file_modification_truncate
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030430
|
|
|
ff1465 |
- audit_rules_unsuccessful_file_modification_openat
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030440
|
|
|
ff1465 |
- audit_rules_unsuccessful_file_modification_open
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030450
|
|
|
ff1465 |
- audit_rules_unsuccessful_file_modification_open_by_handle_at
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030460
|
|
|
ff1465 |
- audit_rules_unsuccessful_file_modification_ftruncate
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030470
|
|
|
ff1465 |
- audit_rules_unsuccessful_file_modification_creat
|
|
|
ff1465 |
|
|
|
ff1465 |
# RHEL-08-030480
|
|
|
ff1465 |
- audit_rules_dac_modification_chown
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030490
|
|
|
ff1465 |
- - audit_rules_dac_modification_chmod
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030500
|
|
|
ff1465 |
- audit_rules_dac_modification_lchown
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030510
|
|
|
ff1465 |
- audit_rules_dac_modification_fchownat
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030520
|
|
|
ff1465 |
- audit_rules_dac_modification_fchown
|
|
|
ff1465 |
|
|
|
ff1465 |
- # RHEL-08-030530
|
|
|
ff1465 |
+ # RHEL-08-030490
|
|
|
ff1465 |
+ - audit_rules_dac_modification_chmod
|
|
|
ff1465 |
- audit_rules_dac_modification_fchmodat
|
|
|
ff1465 |
-
|
|
|
ff1465 |
- # RHEL-08-030540
|
|
|
ff1465 |
- audit_rules_dac_modification_fchmod
|
|
|
ff1465 |
|
|
|
ff1465 |
# RHEL-08-030550
|