|
 |
7629ac |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_rename.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_rename.rule
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000000..3fdcb3e89d
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_rename.rule
|
|
|
7629ac |
@@ -0,0 +1,46 @@
|
|
|
7629ac |
+documentation_complete: true
|
|
|
7629ac |
+
|
|
|
7629ac |
+prodtype: rhel7,fedora
|
|
|
7629ac |
+
|
|
|
7629ac |
+title: 'Record Unsuccessul Delete Attempts to Files - rename'
|
|
|
7629ac |
+
|
|
|
7629ac |
+description: |-
|
|
|
7629ac |
+ The audit system should collect unsuccessful file deletion
|
|
|
7629ac |
+ attempts for all users and root. If the <tt>auditd</tt> daemon is configured
|
|
|
7629ac |
+ to use the <tt>augenrules</tt> program to read audit rules during daemon
|
|
|
7629ac |
+ startup (the default), add the following lines to a file with suffix
|
|
|
7629ac |
+ <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>.
|
|
|
7629ac |
+ If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
|
|
|
7629ac |
+ utility to read audit rules during daemon startup, add the following lines to
|
|
|
7629ac |
+ <tt>/etc/audit/audit.rules</tt> file.
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
|
|
|
7629ac |
+ If the system is 64 bit then also add the following lines:
|
|
|
7629ac |
+
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
|
|
|
7629ac |
+
|
|
|
7629ac |
+rationale: |-
|
|
|
7629ac |
+ Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing
|
|
|
7629ac |
+ these events could serve as evidence of potential system compromise.
|
|
|
7629ac |
+
|
|
|
7629ac |
+severity: medium
|
|
|
7629ac |
+
|
|
|
7629ac |
+references:
|
|
|
7629ac |
+ cis: 5.2.10
|
|
|
7629ac |
+ cui: 3.1.7
|
|
|
7629ac |
+ disa: 172,2884
|
|
|
7629ac |
+ hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
|
|
|
7629ac |
+ nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
|
|
|
7629ac |
+ ospp@rhel7: FAU_GEN.1.1.c
|
|
|
7629ac |
+ pcidss: Req-10.2.4,Req-10.2.1
|
|
|
7629ac |
+ srg: SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205,SRG-OS-000392-GPOS-00172
|
|
|
7629ac |
+
|
|
|
7629ac |
+{{{ complete_ocil_entry_audit_syscall(syscall="rename") }}}
|
|
|
7629ac |
+
|
|
|
7629ac |
+warnings:
|
|
|
7629ac |
+ - general: |-
|
|
|
7629ac |
+ Note that these rules can be configured in a
|
|
|
7629ac |
+ number of ways while still achieving the desired effect. Here the system calls
|
|
|
7629ac |
+ have been placed independent of other system calls. Grouping these system
|
|
|
7629ac |
+ calls with others as identifying earlier in this guide is more efficient.
|
|
|
7629ac |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_renameat.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_renameat.rule
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000000..848ea3256e
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_renameat.rule
|
|
|
7629ac |
@@ -0,0 +1,46 @@
|
|
|
7629ac |
+documentation_complete: true
|
|
|
7629ac |
+
|
|
|
7629ac |
+prodtype: rhel7,fedora
|
|
|
7629ac |
+
|
|
|
7629ac |
+title: 'Record Unsuccessul Delete Attempts to Files - renameat'
|
|
|
7629ac |
+
|
|
|
7629ac |
+description: |-
|
|
|
7629ac |
+ The audit system should collect unsuccessful file deletion
|
|
|
7629ac |
+ attempts for all users and root. If the <tt>auditd</tt> daemon is configured
|
|
|
7629ac |
+ to use the <tt>augenrules</tt> program to read audit rules during daemon
|
|
|
7629ac |
+ startup (the default), add the following lines to a file with suffix
|
|
|
7629ac |
+ <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>.
|
|
|
7629ac |
+ If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
|
|
|
7629ac |
+ utility to read audit rules during daemon startup, add the following lines to
|
|
|
7629ac |
+ <tt>/etc/audit/audit.rules</tt> file.
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
|
|
|
7629ac |
+ If the system is 64 bit then also add the following lines:
|
|
|
7629ac |
+
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
|
|
|
7629ac |
+
|
|
|
7629ac |
+rationale: |-
|
|
|
7629ac |
+ Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing
|
|
|
7629ac |
+ these events could serve as evidence of potential system compromise.
|
|
|
7629ac |
+
|
|
|
7629ac |
+severity: medium
|
|
|
7629ac |
+
|
|
|
7629ac |
+references:
|
|
|
7629ac |
+ cis: 5.2.10
|
|
|
7629ac |
+ cui: 3.1.7
|
|
|
7629ac |
+ disa: 172,2884
|
|
|
7629ac |
+ hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
|
|
|
7629ac |
+ nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
|
|
|
7629ac |
+ ospp@rhel7: FAU_GEN.1.1.c
|
|
|
7629ac |
+ pcidss: Req-10.2.4,Req-10.2.1
|
|
|
7629ac |
+ srg: SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205,SRG-OS-000392-GPOS-00172
|
|
|
7629ac |
+
|
|
|
7629ac |
+{{{ complete_ocil_entry_audit_syscall(syscall="renameat") }}}
|
|
|
7629ac |
+
|
|
|
7629ac |
+warnings:
|
|
|
7629ac |
+ - general: |-
|
|
|
7629ac |
+ Note that these rules can be configured in a
|
|
|
7629ac |
+ number of ways while still achieving the desired effect. Here the system calls
|
|
|
7629ac |
+ have been placed independent of other system calls. Grouping these system
|
|
|
7629ac |
+ calls with others as identifying earlier in this guide is more efficient.
|
|
|
7629ac |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_unlink.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_unlink.rule
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000000..8a64a965ea
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_unlink.rule
|
|
|
7629ac |
@@ -0,0 +1,46 @@
|
|
|
7629ac |
+documentation_complete: true
|
|
|
7629ac |
+
|
|
|
7629ac |
+prodtype: rhel7,fedora
|
|
|
7629ac |
+
|
|
|
7629ac |
+title: 'Record Unsuccessul Delete Attempts to Files - unlink'
|
|
|
7629ac |
+
|
|
|
7629ac |
+description: |-
|
|
|
7629ac |
+ The audit system should collect unsuccessful file deletion
|
|
|
7629ac |
+ attempts for all users and root. If the <tt>auditd</tt> daemon is configured
|
|
|
7629ac |
+ to use the <tt>augenrules</tt> program to read audit rules during daemon
|
|
|
7629ac |
+ startup (the default), add the following lines to a file with suffix
|
|
|
7629ac |
+ <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>.
|
|
|
7629ac |
+ If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
|
|
|
7629ac |
+ utility to read audit rules during daemon startup, add the following lines to
|
|
|
7629ac |
+ <tt>/etc/audit/audit.rules</tt> file.
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S unlink -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S unlink -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
|
|
|
7629ac |
+ If the system is 64 bit then also add the following lines:
|
|
|
7629ac |
+
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S unlink -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S unlink -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
|
|
|
7629ac |
+
|
|
|
7629ac |
+rationale: |-
|
|
|
7629ac |
+ Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing
|
|
|
7629ac |
+ these events could serve as evidence of potential system compromise.
|
|
|
7629ac |
+
|
|
|
7629ac |
+severity: medium
|
|
|
7629ac |
+
|
|
|
7629ac |
+references:
|
|
|
7629ac |
+ cis: 5.2.10
|
|
|
7629ac |
+ cui: 3.1.7
|
|
|
7629ac |
+ disa: 172,2884
|
|
|
7629ac |
+ hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
|
|
|
7629ac |
+ nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
|
|
|
7629ac |
+ ospp@rhel7: FAU_GEN.1.1.c
|
|
|
7629ac |
+ pcidss: Req-10.2.4,Req-10.2.1
|
|
|
7629ac |
+ srg: SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205,SRG-OS-000392-GPOS-00172
|
|
|
7629ac |
+
|
|
|
7629ac |
+{{{ complete_ocil_entry_audit_syscall(syscall="unlink") }}}
|
|
|
7629ac |
+
|
|
|
7629ac |
+warnings:
|
|
|
7629ac |
+ - general: |-
|
|
|
7629ac |
+ Note that these rules can be configured in a
|
|
|
7629ac |
+ number of ways while still achieving the desired effect. Here the system calls
|
|
|
7629ac |
+ have been placed independent of other system calls. Grouping these system
|
|
|
7629ac |
+ calls with others as identifying earlier in this guide is more efficient.
|
|
|
7629ac |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_unlinkat.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_unlinkat.rule
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000000..c89d7d880b
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_unlinkat.rule
|
|
|
7629ac |
@@ -0,0 +1,46 @@
|
|
|
7629ac |
+documentation_complete: true
|
|
|
7629ac |
+
|
|
|
7629ac |
+prodtype: rhel7,fedora
|
|
|
7629ac |
+
|
|
|
7629ac |
+title: 'Record Unsuccessul Delete Attempts to Files - unlinkat'
|
|
|
7629ac |
+
|
|
|
7629ac |
+description: |-
|
|
|
7629ac |
+ The audit system should collect unsuccessful file deletion
|
|
|
7629ac |
+ attempts for all users and root. If the <tt>auditd</tt> daemon is configured
|
|
|
7629ac |
+ to use the <tt>augenrules</tt> program to read audit rules during daemon
|
|
|
7629ac |
+ startup (the default), add the following lines to a file with suffix
|
|
|
7629ac |
+ <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>.
|
|
|
7629ac |
+ If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
|
|
|
7629ac |
+ utility to read audit rules during daemon startup, add the following lines to
|
|
|
7629ac |
+ <tt>/etc/audit/audit.rules</tt> file.
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S unlinkat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
|
|
|
7629ac |
+ -a always,exit -F arch=b32 -S unlinkat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
|
|
|
7629ac |
+ If the system is 64 bit then also add the following lines:
|
|
|
7629ac |
+
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S unlinkat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
|
|
|
7629ac |
+ -a always,exit -F arch=b64 -S unlinkat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
|
|
|
7629ac |
+
|
|
|
7629ac |
+rationale: |-
|
|
|
7629ac |
+ Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing
|
|
|
7629ac |
+ these events could serve as evidence of potential system compromise.
|
|
|
7629ac |
+
|
|
|
7629ac |
+severity: medium
|
|
|
7629ac |
+
|
|
|
7629ac |
+references:
|
|
|
7629ac |
+ cis: 5.2.10
|
|
|
7629ac |
+ cui: 3.1.7
|
|
|
7629ac |
+ disa: 172,2884
|
|
|
7629ac |
+ hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
|
|
|
7629ac |
+ nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
|
|
|
7629ac |
+ ospp@rhel7: FAU_GEN.1.1.c
|
|
|
7629ac |
+ pcidss: Req-10.2.4,Req-10.2.1
|
|
|
7629ac |
+ srg: SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205,SRG-OS-000392-GPOS-00172
|
|
|
7629ac |
+
|
|
|
7629ac |
+{{{ complete_ocil_entry_audit_syscall(syscall="unlinkat") }}}
|
|
|
7629ac |
+
|
|
|
7629ac |
+warnings:
|
|
|
7629ac |
+ - general: |-
|
|
|
7629ac |
+ Note that these rules can be configured in a
|
|
|
7629ac |
+ number of ways while still achieving the desired effect. Here the system calls
|
|
|
7629ac |
+ have been placed independent of other system calls. Grouping these system
|
|
|
7629ac |
+ calls with others as identifying earlier in this guide is more efficient.
|
|
|
7629ac |
diff --git a/rhel7/profiles/ospp42-draft.profile b/rhel7/profiles/ospp42-draft.profile
|
|
|
7629ac |
index 6ca2b4b58f..1f5e45a436 100644
|
|
|
7629ac |
--- a/rhel7/profiles/ospp42-draft.profile
|
|
|
7629ac |
+++ b/rhel7/profiles/ospp42-draft.profile
|
|
|
7629ac |
@@ -90,6 +90,10 @@ selections:
|
|
|
7629ac |
- audit_rules_unsuccessful_file_modification_open
|
|
|
7629ac |
- audit_rules_unsuccessful_file_modification_ftruncate
|
|
|
7629ac |
- audit_rules_unsuccessful_file_modification_truncate
|
|
|
7629ac |
+ - audit_rules_unsuccessful_file_modification_unlink
|
|
|
7629ac |
+ - audit_rules_unsuccessful_file_modification_unlinkat
|
|
|
7629ac |
+ - audit_rules_unsuccessful_file_modification_rename
|
|
|
7629ac |
+ - audit_rules_unsuccessful_file_modification_renameat
|
|
|
7629ac |
- audit_rules_file_deletion_events_renameat
|
|
|
7629ac |
- audit_rules_file_deletion_events_rename
|
|
|
7629ac |
- audit_rules_file_deletion_events_rmdir
|
|
|
7629ac |
diff --git a/shared/templates/csv/audit_rules_unsuccessful_file_modification.csv b/shared/templates/csv/audit_rules_unsuccessful_file_modification.csv
|
|
|
7629ac |
index 632bd19a68..3246204984 100644
|
|
|
7629ac |
--- a/shared/templates/csv/audit_rules_unsuccessful_file_modification.csv
|
|
|
7629ac |
+++ b/shared/templates/csv/audit_rules_unsuccessful_file_modification.csv
|
|
|
7629ac |
@@ -3,4 +3,8 @@ ftruncate
|
|
|
7629ac |
open
|
|
|
7629ac |
openat
|
|
|
7629ac |
open_by_handle_at
|
|
|
7629ac |
+rename
|
|
|
7629ac |
+renameat
|
|
|
7629ac |
truncate
|
|
|
7629ac |
+unlink
|
|
|
7629ac |
+unlinkat
|
|
|
7629ac |
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_unsuccessful_file_modification/rule_audit_rules_unsuccessful_file_modification_unlink/default.pass.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_unsuccessful_file_modification/rule_audit_rules_unsuccessful_file_modification_unlink/default.pass.sh
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000000..a6b47565ea
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_unsuccessful_file_modification/rule_audit_rules_unsuccessful_file_modification_unlink/default.pass.sh
|
|
|
7629ac |
@@ -0,0 +1,8 @@
|
|
|
7629ac |
+#!/bin/bash
|
|
|
7629ac |
+
|
|
|
7629ac |
+# profiles = xccdf_org.ssgproject.content_profile_ospp
|
|
|
7629ac |
+
|
|
|
7629ac |
+echo "-a always,exit -F arch=b32 -S unlink -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-delete" >> /etc/audit/rules.d/unsuccessful-delete.rules
|
|
|
7629ac |
+echo "-a always,exit -F arch=b64 -S unlink -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-delete" >> /etc/audit/rules.d/unsuccessful-delete.rules
|
|
|
7629ac |
+echo "-a always,exit -F arch=b32 -S unlink -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-delete" >> /etc/audit/rules.d/unsuccessful-delete.rules
|
|
|
7629ac |
+echo "-a always,exit -F arch=b64 -S unlink -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-delete" >> /etc/audit/rules.d/unsuccessful-delete.rules
|
|
|
7629ac |
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_unsuccessful_file_modification/rule_audit_rules_unsuccessful_file_modification_unlink/empty.fail.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_unsuccessful_file_modification/rule_audit_rules_unsuccessful_file_modification_unlink/empty.fail.sh
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000000..d703da5cf8
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_unsuccessful_file_modification/rule_audit_rules_unsuccessful_file_modification_unlink/empty.fail.sh
|
|
|
7629ac |
@@ -0,0 +1,7 @@
|
|
|
7629ac |
+#!/bin/bash
|
|
|
7629ac |
+
|
|
|
7629ac |
+# profiles = xccdf_org.ssgproject.content_profile_ospp
|
|
|
7629ac |
+
|
|
|
7629ac |
+rm -f /etc/audit/rules.d/*
|
|
|
7629ac |
+> /etc/audit/audit.rules
|
|
|
7629ac |
+true
|
|
|
7629ac |
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_unsuccessful_file_modification/rule_audit_rules_unsuccessful_file_modification_unlink/only_eacces.fail.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_unsuccessful_file_modification/rule_audit_rules_unsuccessful_file_modification_unlink/only_eacces.fail.sh
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000000..07d6e6b22b
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_unsuccessful_file_modification/rule_audit_rules_unsuccessful_file_modification_unlink/only_eacces.fail.sh
|
|
|
7629ac |
@@ -0,0 +1,6 @@
|
|
|
7629ac |
+#!/bin/bash
|
|
|
7629ac |
+
|
|
|
7629ac |
+# profiles = xccdf_org.ssgproject.content_profile_ospp
|
|
|
7629ac |
+
|
|
|
7629ac |
+echo "-a always,exit -F arch=b32 -S unlink -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-delete" >> /etc/audit/rules.d/unsuccessful-delete.rules
|
|
|
7629ac |
+echo "-a always,exit -F arch=b64 -S unlink -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-delete" >> /etc/audit/rules.d/unsuccessful-delete.rules
|