Blame SOURCES/scap-security-guide-0.1.41-template_syscall_rules.patch

7629ac
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat.rule
7629ac
new file mode 100644
7629ac
index 0000000000..91fcecd155
7629ac
--- /dev/null
7629ac
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat.rule
7629ac
@@ -0,0 +1,55 @@
7629ac
+documentation_complete: true
7629ac
+
7629ac
+prodtype: rhel7,fedora
7629ac
+
7629ac
+title: 'Record Unauthorized Creation Attempts to Files - open_by_handle_at O_CREAT'
7629ac
+
7629ac
+
7629ac
+description: |-
7629ac
+    The audit system should collect unauthorized file accesses for
7629ac
+    all users and root. The <tt>open_by_handle_at</tt> syscall can be used to create new files
7629ac
+    when O_CREAT flag is specified.
7629ac
+    The following auidt rules will asure that unsuccessful attempts to create a
7629ac
+    file via <tt>open_by_handle_at</tt> syscall are collected.
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>augenrules</tt>
7629ac
+    program to read audit rules during daemon startup (the default), add the
7629ac
+    rules below to a file with suffix <tt>.rules</tt> in the directory
7629ac
+    <tt>/etc/audit/rules.d</tt>.
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
7629ac
+    utility to read audit rules during daemon startup, add the rules below to
7629ac
+    <tt>/etc/audit/audit.rules</tt> file.
7629ac
+    
7629ac
+    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
+    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
+    
7629ac
+    If the system is 64 bit then also add the following lines:
7629ac
+    
7629ac
+    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
+    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
+    
7629ac
+
7629ac
+rationale: |-
7629ac
+    Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
7629ac
+    these events could serve as evidence of potential system compromise.
7629ac
+
7629ac
+severity: medium
7629ac
+
7629ac
+references:
7629ac
+    cis: 5.2.10
7629ac
+    cui: 3.1.7
7629ac
+    disa: 172,2884
7629ac
+    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
7629ac
+    nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
7629ac
+    ospp@rhel7: FAU_GEN.1.1.c
7629ac
+    pcidss: Req-10.2.4,Req-10.2.1
7629ac
+    srg: SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205,SRG-OS-000392-GPOS-00172
7629ac
+
7629ac
+{{{ complete_ocil_entry_audit_syscall(syscall="open_by_handle_at") }}}
7629ac
+
7629ac
+warnings:
7629ac
+    - general: |-
7629ac
+        Note that these rules can be configured in a
7629ac
+        number of ways while still achieving the desired effect. Here the system calls
7629ac
+        have been placed independent of other system calls. Grouping system calls related
7629ac
+        to the same event is more efficient. See the following example:
7629ac
+        
-a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write.rule
7629ac
new file mode 100644
7629ac
index 0000000000..06e96678f2
7629ac
--- /dev/null
7629ac
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write.rule
7629ac
@@ -0,0 +1,54 @@
7629ac
+documentation_complete: true
7629ac
+
7629ac
+prodtype: rhel7,fedora
7629ac
+
7629ac
+title: 'Record Unauthorized Modification Attempts to Files - open_by_handle_at O_TRUNC'
7629ac
+
7629ac
+description: |-
7629ac
+    The audit system should collect detailed unauthorized file accesses for
7629ac
+    all users and root. The <tt>open_by_handle_at</tt> syscall can be used to modify files
7629ac
+    if called for write operation of with O_TRUNC flag.
7629ac
+    The following auidt rules will asure that unsuccessful attempts to modify a
7629ac
+    file via <tt>open_by_handle_at</tt> syscall are collected.
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>augenrules</tt>
7629ac
+    program to read audit rules during daemon startup (the default), add the
7629ac
+    rules below to a file with suffix <tt>.rules</tt> in the directory
7629ac
+    <tt>/etc/audit/rules.d</tt>.
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
7629ac
+    utility to read audit rules during daemon startup, add the rules below to
7629ac
+    <tt>/etc/audit/audit.rules</tt> file.
7629ac
+    
7629ac
+    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
+    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
+    
7629ac
+    If the system is 64 bit then also add the following lines:
7629ac
+    
7629ac
+    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
+    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
+    
7629ac
+
7629ac
+rationale: |-
7629ac
+    Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
7629ac
+    these events could serve as evidence of potential system compromise.
7629ac
+
7629ac
+severity: medium
7629ac
+
7629ac
+references:
7629ac
+    cis: 5.2.10
7629ac
+    cui: 3.1.7
7629ac
+    disa: 172,2884
7629ac
+    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
7629ac
+    nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
7629ac
+    ospp@rhel7: FAU_GEN.1.1.c
7629ac
+    pcidss: Req-10.2.4,Req-10.2.1
7629ac
+    srg: SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205,SRG-OS-000392-GPOS-00172
7629ac
+
7629ac
+{{{ complete_ocil_entry_audit_syscall(syscall="open_by_handle_at") }}}
7629ac
+
7629ac
+warnings:
7629ac
+    - general: |-
7629ac
+        Note that these rules can be configured in a
7629ac
+        number of ways while still achieving the desired effect. Here the system calls
7629ac
+        have been placed independent of other system calls. Grouping system calls related
7629ac
+        to the same event is more efficient. See the following example:
7629ac
+        
-a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order.rule
7629ac
new file mode 100644
7629ac
index 0000000000..0ecd5fff2f
7629ac
--- /dev/null
7629ac
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order.rule
7629ac
@@ -0,0 +1,58 @@
7629ac
+documentation_complete: true
7629ac
+
7629ac
+prodtype: rhel7,fedora
7629ac
+
7629ac
+title: 'Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly'
7629ac
+
7629ac
+description: |-
7629ac
+    The audit system should collect detailed unauthorized file
7629ac
+    accesses for all users and root.
7629ac
+    To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access
7629ac
+    of files via <tt>open_by_handle_at</tt> syscall the audit rules collecting these events need to be in certain order.
7629ac
+    The more specific rules need to come before the less specific rules. The reason for that is that more
7629ac
+    specific rules cover a subset of events covered in the less specific rules, thus, they need to come
7629ac
+    before to not be overshadowed by less specific rules, which match a bigger set of events.
7629ac
+    Make sure that rules for unsuccessful calls of <tt>open_by_handle_at</tt> syscall are in the order shown below.
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>augenrules</tt>
7629ac
+    program to read audit rules during daemon startup (the default), check the order of
7629ac
+    rules below in a file with suffix <tt>.rules</tt> in the directory
7629ac
+    <tt>/etc/audit/rules.d</tt>.
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
7629ac
+    utility to read audit rules during daemon startup, check the order of rules below in
7629ac
+    <tt>/etc/audit/audit.rules</tt> file.
7629ac
+    
7629ac
+    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
+    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
+    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
+    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
+    -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
7629ac
+    -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
7629ac
+    
7629ac
+    If the system is 64 bit then also add the following lines:
7629ac
+    
7629ac
+    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
+    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
+    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
+    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
+    -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
7629ac
+    -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
7629ac
+    
7629ac
+
7629ac
+rationale: |-
7629ac
+    The more specific rules cover a subset of events covered by the less specific rules.
7629ac
+    By ordering them from more specific to less specific, it is assured that the less specific
7629ac
+    rule will not catch events better recorded by the more specific rule.
7629ac
+
7629ac
+severity: medium
7629ac
+
7629ac
+references:
7629ac
+    cis: 5.2.10
7629ac
+    cui: 3.1.7
7629ac
+    disa: 172,2884
7629ac
+    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
7629ac
+    nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
7629ac
+    ospp@rhel7: FAU_GEN.1.1.c
7629ac
+    pcidss: Req-10.2.4,Req-10.2.1
7629ac
+    srg: SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205,SRG-OS-000392-GPOS-00172
7629ac
+
7629ac
+{{{ complete_ocil_entry_audit_syscall(syscall="open_by_handle_at") }}}
7629ac
diff --git a/shared/checks/oval/audit_rules_unsuccessful_file_modification_open_o_creat.xml
7629ac
deleted file mode 100644
7629ac
index 3eb97c1234..0000000000
7629ac
--- a/shared/checks/oval/audit_rules_unsuccessful_file_modification_open_o_creat.xml
7629ac
+++ /dev/null
7629ac
@@ -1,200 +0,0 @@
7629ac
-<def-group>
7629ac
-  <definition class="compliance" id="audit_rules_unsuccessful_file_modification_open_o_creat" version="1">
7629ac
-    <metadata>
7629ac
-      <title>Ensure auditd Collects Information on Unsuccesful Creation Attempts to Files - open o_creat</title>
7629ac
-      <affected family="unix">
7629ac
-        <platform>Red Hat Enterprise Linux 7</platform>
7629ac
-        <platform>multi_platform_fedora</platform>
7629ac
-      </affected>
7629ac
-      <description>Audit rules about the information on the unsuccessful use of open O_CREAT is enabled.</description>
7629ac
-    </metadata>
7629ac
-
7629ac
-    <criteria operator="OR">
7629ac
-
7629ac
-      
7629ac
-      <criteria operator="AND">
7629ac
-        <extend_definition comment="audit augenrules" definition_ref="audit_rules_augenrules" />
7629ac
-        <criterion comment="Verify audit rule open 32bit a2&0100 eacces augenrules exists" test_ref="test_arufm_open_o_creat_32bit_a20100_eacces_augenrules" />
7629ac
-        <criterion comment="Verify audit rule open 32bit a2&0100 eperm augenrules exists" test_ref="test_arufm_open_o_creat_32bit_a20100_eperm_augenrules" />
7629ac
-
7629ac
-        <criteria operator="OR">
7629ac
-          
7629ac
-          <extend_definition comment="64-bit system" definition_ref="system_info_architecture_64bit" negate="true" />
7629ac
-          
7629ac
-          <criteria operator="AND">
7629ac
-            <criterion comment="Verify audit rule open 64bit a2&0100 eacces augenrules exists" test_ref="test_arufm_open_o_creat_64bit_a20100_eacces_augenrules" />
7629ac
-            <criterion comment="Verify audit rule open 64bit a2&0100 eperm augenrules exists" test_ref="test_arufm_open_o_creat_64bit_a20100_eperm_augenrules" />
7629ac
-          </criteria>
7629ac
-        </criteria>
7629ac
-      </criteria>
7629ac
-
7629ac
-      
7629ac
-      <criteria operator="AND">
7629ac
-        <extend_definition comment="audit auditctl" definition_ref="audit_rules_auditctl" />
7629ac
-        <criterion comment="Verify audit rule open 32bit a2&0100 eacces auditctl exists" test_ref="test_arufm_open_o_creat_32bit_a20100_eacces_auditctl" />
7629ac
-        <criterion comment="Verify audit rule open 32bit a2&0100 eperm auditctl exists" test_ref="test_arufm_open_o_creat_32bit_a20100_eperm_auditctl" />
7629ac
-
7629ac
-        <criteria operator="OR">
7629ac
-          
7629ac
-          <extend_definition comment="64-bit_system" definition_ref="system_info_architecture_64bit" negate="true" />
7629ac
-          
7629ac
-          <criteria operator="AND">
7629ac
-            <criterion comment="Verify audit rule open 64bit a2&0100 eacces auditctl exists" test_ref="test_arufm_open_o_creat_64bit_a20100_eacces_auditctl" />
7629ac
-            <criterion comment="Verify audit rule open 64bit a2&0100 eperm auditctl exists" test_ref="test_arufm_open_o_creat_64bit_a20100_eperm_auditctl" />
7629ac
-
7629ac
-          </criteria>
7629ac
-        </criteria>
7629ac
-      </criteria>
7629ac
-
7629ac
-    </criteria>
7629ac
-  </definition>
7629ac
-
7629ac
-  
7629ac
-  <constant_variable id="var_audit_rule_open_o_creat_32bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
7629ac
-      <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S(?:[\s]+open[\s]+|(?:[\s]+|[,])open(?:[\s]+|[,])))[\S]*[\s]*</value>
7629ac
-  </constant_variable>
7629ac
-  <constant_variable id="var_audit_rule_open_o_creat_64bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
7629ac
-      <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S(?:[\s]+open[\s]+|(?:[\s]+|[,])open(?:[\s]+|[,])))[\S]*[\s]*</value>
7629ac
-  </constant_variable>
7629ac
-  <constant_variable id="var_audit_rule_open_o_creat_tail" version="1" datatype="string" comment="audit rule auid and key">
7629ac
-    <value>[\s]+(?:-F\s+auid>={{{ auid }}}[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
7629ac
-  </constant_variable>
7629ac
-
7629ac
-  
7629ac
-  <constant_variable id="var_audit_rule_open_o_creat_separator_regex" version="1" datatype="string" comment="audit rule auid and key">
7629ac
-    <value>(?:[^.]|\.\s)*</value>
7629ac
-  </constant_variable>
7629ac
-
7629ac
-  
7629ac
-  <local_variable id="var_audit_rule_open_o_creat_32bit_a20100_eacces_regex" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EACCES syscall">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_o_creat_32bit_head" />
7629ac
-      <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_o_creat_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-
7629ac
-  
7629ac
-  <local_variable id="var_audit_rule_open_o_creat_32bit_a20100_eperm_regex" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EPERM syscall">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_o_creat_32bit_head" />
7629ac
-      <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_o_creat_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-
7629ac
-  
7629ac
-  <local_variable id="var_audit_rule_open_o_creat_64bit_a20100_eacces_regex" version="1" datatype="string" comment="Expression to match 64bit open O_CREAT EACCES syscall">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_o_creat_64bit_head" />
7629ac
-      <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_o_creat_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-
7629ac
-  
7629ac
-  <local_variable id="var_audit_rule_open_o_creat_64bit_a20100_eperm_regex" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EPERM syscall">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_o_creat_64bit_head" />
7629ac
-      <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_o_creat_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_o_creat_32bit_a20100_eacces_augenrules" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_o_creat_32bit_a20100_eacces_augenrules" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_o_creat_32bit_a20100_eacces_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_creat_32bit_a20100_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_o_creat_32bit_a20100_eperm_augenrules" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_o_creat_32bit_a20100_eperm_augenrules" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_o_creat_32bit_a20100_eperm_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_creat_32bit_a20100_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_o_creat_64bit_a20100_eacces_augenrules" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_o_creat_64bit_a20100_eacces_augenrules" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_o_creat_64bit_a20100_eacces_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_creat_64bit_a20100_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_o_creat_64bit_a20100_eperm_augenrules" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_o_creat_64bit_a20100_eperm_augenrules" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_o_creat_64bit_a20100_eperm_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_creat_64bit_a20100_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_o_creat_32bit_a20100_eacces_auditctl" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_o_creat_32bit_a20100_eacces_auditctl" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_o_creat_32bit_a20100_eacces_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_creat_32bit_a20100_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_o_creat_32bit_a20100_eperm_auditctl" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_o_creat_32bit_a20100_eperm_auditctl" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_o_creat_32bit_a20100_eperm_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_creat_32bit_a20100_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_o_creat_64bit_a20100_eacces_auditctl" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_o_creat_64bit_a20100_eacces_auditctl" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_o_creat_64bit_a20100_eacces_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_creat_64bit_a20100_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_o_creat_64bit_a20100_eperm_auditctl" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_o_creat_64bit_a20100_eperm_auditctl" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_o_creat_64bit_a20100_eperm_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_creat_64bit_a20100_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-</def-group>
7629ac
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_o_creat.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_o_creat.rule
7629ac
index c879183de2..a78f614c8f 100644
7629ac
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_o_creat.rule
7629ac
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_o_creat.rule
7629ac
@@ -2,7 +2,7 @@ documentation_complete: true
7629ac
 
7629ac
 prodtype: rhel7,fedora
7629ac
 
7629ac
-title: 'Record Unauthorized Creation Attempts to Files (unsuccessful) - open O_CREAT'
7629ac
+title: 'Record Unauthorized Creation Attempts to Files - open O_CREAT'
7629ac
 
7629ac
 
7629ac
 description: |-
7629ac
@@ -50,5 +50,6 @@ warnings:
7629ac
     - general: |-
7629ac
         Note that these rules can be configured in a
7629ac
         number of ways while still achieving the desired effect. Here the system calls
7629ac
-        have been placed independent of other system calls. Grouping these system
7629ac
-        calls with others as identifying earlier in this guide is more efficient.
7629ac
+        have been placed independent of other system calls. Grouping system calls related
7629ac
+        to the same event is more efficient. See the following example:
7629ac
+        
-a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
diff --git a/shared/checks/oval/audit_rules_unsuccessful_file_modification_open_o_trunc_write.xml
7629ac
deleted file mode 100644
7629ac
index 49540d8d4c..0000000000
7629ac
--- a/shared/checks/oval/audit_rules_unsuccessful_file_modification_open_o_trunc_write.xml
7629ac
+++ /dev/null
7629ac
@@ -1,200 +0,0 @@
7629ac
-<def-group>
7629ac
-  <definition class="compliance" id="audit_rules_unsuccessful_file_modification_open_o_trunc_write" version="1">
7629ac
-    <metadata>
7629ac
-      <title>Ensure auditd Collects Information on Unsuccesful Creation Attempts to Files - open o_trunc</title>
7629ac
-      <affected family="unix">
7629ac
-        <platform>Red Hat Enterprise Linux 7</platform>
7629ac
-        <platform>multi_platform_fedora</platform>
7629ac
-      </affected>
7629ac
-      <description>Audit rules about the information on the unsuccessful use of open O_TRUNC is enabled.</description>
7629ac
-    </metadata>
7629ac
-
7629ac
-    <criteria operator="OR">
7629ac
-
7629ac
-      
7629ac
-      <criteria operator="AND">
7629ac
-        <extend_definition comment="audit augenrules" definition_ref="audit_rules_augenrules" />
7629ac
-        <criterion comment="Verify audit rule open 32bit a2&01003 eacces augenrules exists" test_ref="test_arufm_open_o_trunc_32bit_a201003_eacces_augenrules" />
7629ac
-        <criterion comment="Verify audit rule open 32bit a2&01003 eperm augenrules exists" test_ref="test_arufm_open_o_trunc_32bit_a201003_eperm_augenrules" />
7629ac
-
7629ac
-        <criteria operator="OR">
7629ac
-          
7629ac
-          <extend_definition comment="64-bit system" definition_ref="system_info_architecture_64bit" negate="true" />
7629ac
-          
7629ac
-          <criteria operator="AND">
7629ac
-            <criterion comment="Verify audit rule open 64bit a2&01003 eacces augenrules exists" test_ref="test_arufm_open_o_trunc_64bit_a201003_eacces_augenrules" />
7629ac
-            <criterion comment="Verify audit rule open 64bit a2&01003 eperm augenrules exists" test_ref="test_arufm_open_o_trunc_64bit_a201003_eperm_augenrules" />
7629ac
-          </criteria>
7629ac
-        </criteria>
7629ac
-      </criteria>
7629ac
-
7629ac
-      
7629ac
-      <criteria operator="AND">
7629ac
-        <extend_definition comment="audit auditctl" definition_ref="audit_rules_auditctl" />
7629ac
-        <criterion comment="Verify audit rule open 32bit a2&01003 eacces auditctl exists" test_ref="test_arufm_open_o_trunc_32bit_a201003_eacces_auditctl" />
7629ac
-        <criterion comment="Verify audit rule open 32bit a2&01003 eperm auditctl exists" test_ref="test_arufm_open_o_trunc_32bit_a201003_eperm_auditctl" />
7629ac
-
7629ac
-        <criteria operator="OR">
7629ac
-          
7629ac
-          <extend_definition comment="64-bit_system" definition_ref="system_info_architecture_64bit" negate="true" />
7629ac
-          
7629ac
-          <criteria operator="AND">
7629ac
-            <criterion comment="Verify audit rule open 64bit a2&01003 eacces auditctl exists" test_ref="test_arufm_open_o_trunc_64bit_a201003_eacces_auditctl" />
7629ac
-            <criterion comment="Verify audit rule open 64bit a2&01003 eperm auditctl exists" test_ref="test_arufm_open_o_trunc_64bit_a201003_eperm_auditctl" />
7629ac
-
7629ac
-          </criteria>
7629ac
-        </criteria>
7629ac
-      </criteria>
7629ac
-
7629ac
-    </criteria>
7629ac
-  </definition>
7629ac
-
7629ac
-  
7629ac
-  <constant_variable id="var_audit_rule_open_o_trunc_32bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
7629ac
-      <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S(?:[\s]+open[\s]+|(?:[\s]+|[,])open(?:[\s]+|[,])))[\S]*[\s]*</value>
7629ac
-  </constant_variable>
7629ac
-  <constant_variable id="var_audit_rule_open_o_trunc_64bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
7629ac
-      <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S(?:[\s]+open[\s]+|(?:[\s]+|[,])open(?:[\s]+|[,])))[\S]*[\s]*</value>
7629ac
-  </constant_variable>
7629ac
-  <constant_variable id="var_audit_rule_open_o_trunc_tail" version="1" datatype="string" comment="audit rule auid and key">
7629ac
-    <value>[\s]+(?:-F\s+auid>={{{ auid }}}[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
7629ac
-  </constant_variable>
7629ac
-
7629ac
-  
7629ac
-  <constant_variable id="var_audit_rule_open_o_trunc_separator_regex" version="1" datatype="string" comment="audit rule auid and key">
7629ac
-    <value>(?:[^.]|\.\s)*</value>
7629ac
-  </constant_variable>
7629ac
-
7629ac
-  
7629ac
-  <local_variable id="var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex" version="1" datatype="string" comment="Expression to match 32bit open O_TRUNC EACCES syscall">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_o_trunc_32bit_head" />
7629ac
-      <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_o_trunc_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-
7629ac
-  
7629ac
-  <local_variable id="var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex" version="1" datatype="string" comment="Expression to match 32bit open O_TRUNC EPERM EACCES syscall">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_o_trunc_32bit_head" />
7629ac
-      <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_o_trunc_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-
7629ac
-  
7629ac
-  <local_variable id="var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex" version="1" datatype="string" comment="Expression to match 64bit open O_TRUNC EACCES syscall">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_o_trunc_64bit_head" />
7629ac
-      <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_o_trunc_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-
7629ac
-  
7629ac
-  <local_variable id="var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex" version="1" datatype="string" comment="Expression to match 64bit open O_TRUNC EPERM syscall">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_o_trunc_64bit_head" />
7629ac
-      <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_o_trunc_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_o_trunc_32bit_a201003_eacces_augenrules" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_o_trunc_32bit_a201003_eacces_augenrules" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_o_trunc_32bit_a201003_eacces_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_o_trunc_32bit_a201003_eperm_augenrules" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_o_trunc_32bit_a201003_eperm_augenrules" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_o_trunc_32bit_a201003_eperm_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_o_trunc_64bit_a201003_eacces_augenrules" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_o_trunc_64bit_a201003_eacces_augenrules" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_o_trunc_64bit_a201003_eacces_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_o_trunc_64bit_a201003_eperm_augenrules" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_o_trunc_64bit_a201003_eperm_augenrules" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_o_trunc_64bit_a201003_eperm_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_o_trunc_32bit_a201003_eacces_auditctl" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_o_trunc_32bit_a201003_eacces_auditctl" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_o_trunc_32bit_a201003_eacces_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_o_trunc_32bit_a201003_eperm_auditctl" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_o_trunc_32bit_a201003_eperm_auditctl" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_o_trunc_32bit_a201003_eperm_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_o_trunc_64bit_a201003_eacces_auditctl" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_o_trunc_64bit_a201003_eacces_auditctl" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_o_trunc_64bit_a201003_eacces_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_o_trunc_64bit_a201003_eperm_auditctl" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_o_trunc_64bit_a201003_eperm_auditctl" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_o_trunc_64bit_a201003_eperm_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-</def-group>
7629ac
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_o_trunc_write.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_o_trunc_write.rule
7629ac
index 8525b31bb1..bf5bae97c5 100644
7629ac
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_o_trunc_write.rule
7629ac
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_o_trunc_write.rule
7629ac
@@ -2,7 +2,7 @@ documentation_complete: true
7629ac
 
7629ac
 prodtype: rhel7,fedora
7629ac
 
7629ac
-title: 'Record Unauthorized Modification Attempts to Files (unsuccessful) - open O_TRUNC'
7629ac
+title: 'Record Unauthorized Modification Attempts to Files - open O_TRUNC'
7629ac
 
7629ac
 description: |-
7629ac
     The audit system should collect detailed unauthorized file accesses for
7629ac
@@ -49,5 +49,6 @@ warnings:
7629ac
     - general: |-
7629ac
         Note that these rules can be configured in a
7629ac
         number of ways while still achieving the desired effect. Here the system calls
7629ac
-        have been placed independent of other system calls. Grouping these system
7629ac
-        calls with others as identifying earlier in this guide is more efficient.
7629ac
+        have been placed independent of other system calls. Grouping system calls related
7629ac
+        to the same event is more efficient. See the following example:
7629ac
+        
-a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
diff --git a/shared/checks/oval/audit_rules_unsuccessful_file_modification_open_rule_order.xml
7629ac
deleted file mode 100644
7629ac
index 780fdf60d4..0000000000
7629ac
--- a/shared/checks/oval/audit_rules_unsuccessful_file_modification_open_rule_order.xml
7629ac
+++ /dev/null
7629ac
@@ -1,474 +0,0 @@
7629ac
-<def-group>
7629ac
-  <definition class="compliance" id="audit_rules_unsuccessful_file_modification_open_rule_order" version="1">
7629ac
-    <metadata>
7629ac
-      <title>Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly</title>
7629ac
-      <affected family="unix">
7629ac
-        <platform>Red Hat Enterprise Linux 7</platform>
7629ac
-        <platform>multi_platform_fedora</platform>
7629ac
-      </affected>
7629ac
-      <description>Audit rules about the information on the unsuccessful use of open is configured in the proper rule order.</description>
7629ac
-
7629ac
-    </metadata>
7629ac
-
7629ac
-    <criteria operator="OR">
7629ac
-
7629ac
-      
7629ac
-      <criteria operator="AND">
7629ac
-        <extend_definition comment="audit augenrules" definition_ref="audit_rules_augenrules" />
7629ac
-        <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_open_order_32bit_eacces_augenrules" />
7629ac
-        <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_open_order_32bit_eperm_augenrules" />
7629ac
-
7629ac
-        <criteria operator="OR">
7629ac
-          
7629ac
-          <extend_definition comment="64-bit system" definition_ref="system_info_architecture_64bit" negate="true" />
7629ac
-          
7629ac
-          <criteria operator="AND">
7629ac
-            <criterion comment="audit augenrules 64-bit" test_ref="test_arufm_open_order_64bit_eacces_augenrules" />
7629ac
-            <criterion comment="audit augenrules 64-bit" test_ref="test_arufm_open_order_64bit_eperm_augenrules" />
7629ac
-          </criteria>
7629ac
-        </criteria>
7629ac
-      </criteria>
7629ac
-
7629ac
-      
7629ac
-      <criteria operator="AND">
7629ac
-        <extend_definition comment="audit auditctl" definition_ref="audit_rules_auditctl" />
7629ac
-        <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_open_order_32bit_eacces_auditctl" />
7629ac
-        <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_open_order_32bit_eperm_auditctl" />
7629ac
-
7629ac
-        <criteria operator="OR">
7629ac
-          
7629ac
-          <extend_definition comment="64-bit_system" definition_ref="system_info_architecture_64bit" negate="true" />
7629ac
-          
7629ac
-          <criteria operator="AND">
7629ac
-            <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_open_order_64bit_eacces_auditctl" />
7629ac
-            <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_open_order_64bit_eperm_auditctl" />
7629ac
-
7629ac
-          </criteria>
7629ac
-        </criteria>
7629ac
-      </criteria>
7629ac
-
7629ac
-    </criteria>
7629ac
-  </definition>
7629ac
-
7629ac
-  
7629ac
-  <constant_variable id="var_audit_rule_open_order_32bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
7629ac
-      <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S(?:[\s]+open[\s]+|(?:[\s]+|[,])open(?:[\s]+|[,])))[\S]*[\s]*</value>
7629ac
-  </constant_variable>
7629ac
-  <constant_variable id="var_audit_rule_open_order_64bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
7629ac
-      <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S(?:[\s]+open[\s]+|(?:[\s]+|[,])open(?:[\s]+|[,])))[\S]*[\s]*</value>
7629ac
-  </constant_variable>
7629ac
-  <constant_variable id="var_audit_rule_open_order_tail" version="1" datatype="string" comment="audit rule auid and key">
7629ac
-    <value>[\s]+(?:-F\s+auid>={{{ auid }}}[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
7629ac
-  </constant_variable>
7629ac
-
7629ac
-  
7629ac
-  <constant_variable id="var_audit_rule_open_order_separator_regex" version="1" datatype="string" comment="audit rule auid and key">
7629ac
-    <value>(?:[^.]|\.\s)*</value>
7629ac
-  </constant_variable>
7629ac
-
7629ac
-  
7629ac
-  <local_variable id="var_audit_rule_open_order_32bit_a20100_eacces_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_32bit_head" />
7629ac
-      <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-  <local_variable id="var_audit_rule_open_order_32bit_a201003_eacces_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_32bit_head" />
7629ac
-      <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-  <local_variable id="var_audit_rule_open_order_32bit_eacces_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_32bit_head" />
7629ac
-      <literal_component>(?!.*-F\s+a2&)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-
7629ac
-  
7629ac
-  <local_variable id="var_audit_rule_open_order_32bit_a20100_eperm_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_32bit_head" />
7629ac
-      <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-  <local_variable id="var_audit_rule_open_order_32bit_a201003_eperm_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_32bit_head" />
7629ac
-      <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-  <local_variable id="var_audit_rule_open_order_32bit_eperm_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_32bit_head" />
7629ac
-      <literal_component>(?!.*-F\s+a2&)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-
7629ac
-  
7629ac
-  <local_variable id="var_audit_rule_open_order_64bit_a20100_eacces_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_64bit_head" />
7629ac
-      <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-  <local_variable id="var_audit_rule_open_order_64bit_a201003_eacces_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_64bit_head" />
7629ac
-      <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-  <local_variable id="var_audit_rule_open_order_64bit_eacces_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_64bit_head" />
7629ac
-      <literal_component>(?!.*-F\s+a2&)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-
7629ac
-  
7629ac
-  <local_variable id="var_audit_rule_open_order_64bit_a20100_eperm_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_64bit_head" />
7629ac
-      <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-  <local_variable id="var_audit_rule_open_order_64bit_a201003_eperm_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_64bit_head" />
7629ac
-      <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-  <local_variable id="var_audit_rule_open_order_64bit_eperm_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_64bit_head" />
7629ac
-      <literal_component>(?!.*-F\s+a2&)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_tail" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_32bit_a20100_eacces_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_a20100_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_32bit_a201003_eacces_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_a201003_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_nofilter_32bit_eacces_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <local_variable id="var_arufm_open_order_32bit_eacces_augenrules_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_32bit_a20100_eacces_augenrules" />
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_32bit_a201003_eacces_augenrules" />
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_nofilter_32bit_eacces_augenrules" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_order_32bit_eacces_augenrules" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_order_32bit_eacces_augenrules" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_32bit_eacces_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_arufm_open_order_32bit_eacces_augenrules_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_32bit_a20100_eperm_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_a20100_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_32bit_a201003_eperm_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_a201003_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_nofilter_32bit_eperm_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <local_variable id="var_arufm_open_order_32bit_open_eperm_augenrules_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_32bit_a20100_eperm_augenrules" />
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_32bit_a201003_eperm_augenrules" />
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_nofilter_32bit_eperm_augenrules" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_order_32bit_eperm_augenrules" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_order_32bit_eperm_augenrules" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_32bit_eperm_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_arufm_open_order_32bit_open_eperm_augenrules_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_64bit_a20100_eacces_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_a20100_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_64bit_a201003_eacces_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_a201003_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_nofilter_64bit_eacces_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <local_variable id="var_arufm_open_order_64bit_eacces_augenrules_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_64bit_a20100_eacces_augenrules" />
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_64bit_a201003_eacces_augenrules" />
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_nofilter_64bit_eacces_augenrules" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_order_64bit_eacces_augenrules" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_order_64bit_eacces_augenrules" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_64bit_eacces_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_arufm_open_order_64bit_eacces_augenrules_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_64bit_a20100_eperm_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_a20100_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_64bit_a201003_eperm_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_a201003_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_nofilter_64bit_eperm_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <local_variable id="var_arufm_open_order_64bit_open_eperm_augenrules_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_64bit_a20100_eperm_augenrules" />
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_64bit_a201003_eperm_augenrules" />
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_nofilter_64bit_eperm_augenrules" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_order_64bit_eperm_augenrules" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_order_64bit_eperm_augenrules" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_64bit_eperm_augenrules" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_arufm_open_order_64bit_open_eperm_augenrules_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_32bit_a20100_eacces_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_a20100_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_32bit_a201003_eacces_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_a201003_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_nofilter_32bit_eacces_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <local_variable id="var_arufm_open_order_32bit_auditctl_eacces_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_32bit_a20100_eacces_auditctl" />
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_32bit_a201003_eacces_auditctl" />
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_nofilter_32bit_eacces_auditctl" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_order_32bit_eacces_auditctl" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_order_32bit_eacces_auditctl" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_32bit_eacces_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_arufm_open_order_32bit_auditctl_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_32bit_a20100_eperm_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_a20100_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_32bit_a201003_eperm_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_a201003_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_nofilter_32bit_eperm_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_32bit_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  
7629ac
-  <local_variable id="var_arufm_open_order_32bit_open_auditctl_eperm_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_32bit_a20100_eperm_auditctl" />
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_32bit_a201003_eperm_auditctl" />
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_nofilter_32bit_eperm_auditctl" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-  
7629ac
- comment="Test order of audit 32bit auditctl eperm rules order" id="test_arufm_open_order_32bit_eperm_auditctl" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_order_32bit_eperm_auditctl" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_32bit_eperm_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_arufm_open_order_32bit_open_auditctl_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_64bit_a20100_eacces_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_a20100_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_64bit_a201003_eacces_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_a201003_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_nofilter_64bit_eacces_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <local_variable id="var_arufm_open_order_64bit_auditctl_eacces_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_64bit_a20100_eacces_auditctl" />
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_64bit_a201003_eacces_auditctl" />
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_nofilter_64bit_eacces_auditctl" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_order_64bit_eacces_auditctl" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_order_64bit_eacces_auditctl" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_64bit_eacces_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_arufm_open_order_64bit_auditctl_eacces_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-
7629ac
-  
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_64bit_a20100_eperm_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_a20100_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_64bit_a201003_eperm_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_a201003_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_nofilter_64bit_eperm_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_audit_rule_open_order_64bit_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-  <local_variable id="var_arufm_open_order_64bit_open_auditctl_eperm_regex" version="1" datatype="string" comment="arches to audit">
7629ac
-    <concat>
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_64bit_a20100_eperm_auditctl" />
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_64bit_a201003_eperm_auditctl" />
7629ac
-      <variable_component var_ref="var_audit_rule_open_order_separator_regex" />
7629ac
-      <object_component item_field="text" object_ref="object_arufm_open_order_nofilter_64bit_eperm_auditctl" />
7629ac
-    </concat>
7629ac
-  </local_variable>
7629ac
-  
7629ac
- comment="defined audit rule must exist" id="test_arufm_open_order_64bit_eperm_auditctl" version="1">
7629ac
-    <ind:object object_ref="object_arufm_open_order_64bit_eperm_auditctl" />
7629ac
-  </ind:textfilecontent54_test>
7629ac
-  <ind:textfilecontent54_object id="object_arufm_open_order_64bit_eperm_auditctl" version="1">
7629ac
-    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
-    <ind:pattern operation="pattern match" var_ref="var_arufm_open_order_64bit_open_auditctl_eperm_regex" />
7629ac
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
-  </ind:textfilecontent54_object>
7629ac
-
7629ac
-</def-group>
7629ac
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_rule_order.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_rule_order.rule
7629ac
index 60a1b9de12..0c6949e27d 100644
7629ac
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_rule_order.rule
7629ac
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_open_rule_order.rule
7629ac
@@ -39,8 +39,9 @@ description: |-
7629ac
     
7629ac
 
7629ac
 rationale: |-
7629ac
-    Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
7629ac
-    these events could serve as evidence of potential system compromise.
7629ac
+    The more specific rules cover a subset of events covered by the less specific rules.
7629ac
+    By ordering them from more specific to less specific, it is assured that the less specific
7629ac
+    rule will not catch events better recorded by the more specific rule.
7629ac
 
7629ac
 severity: medium
7629ac
 
7629ac
@@ -55,10 +56,3 @@ references:
7629ac
     srg: SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205,SRG-OS-000392-GPOS-00172
7629ac
 
7629ac
 {{{ complete_ocil_entry_audit_syscall(syscall="open") }}}
7629ac
-
7629ac
-warnings:
7629ac
-    - general: |-
7629ac
-        Note that these rules can be configured in a
7629ac
-        number of ways while still achieving the desired effect. Here the system calls
7629ac
-        have been placed independent of other system calls. Grouping these system
7629ac
-        calls with others as identifying earlier in this guide is more efficient.
7629ac
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_openat_o_creat.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_openat_o_creat.rule
7629ac
new file mode 100644
7629ac
index 0000000000..7470e2f80d
7629ac
--- /dev/null
7629ac
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_openat_o_creat.rule
7629ac
@@ -0,0 +1,55 @@
7629ac
+documentation_complete: true
7629ac
+
7629ac
+prodtype: rhel7,fedora
7629ac
+
7629ac
+title: 'Record Unauthorized Creation Attempts to Files - openat O_CREAT'
7629ac
+
7629ac
+
7629ac
+description: |-
7629ac
+    The audit system should collect unauthorized file accesses for
7629ac
+    all users and root. The <tt>openat</tt> syscall can be used to create new files
7629ac
+    when O_CREAT flag is specified.
7629ac
+    The following auidt rules will asure that unsuccessful attempts to create a
7629ac
+    file via <tt>openat</tt> syscall are collected.
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>augenrules</tt>
7629ac
+    program to read audit rules during daemon startup (the default), add the
7629ac
+    rules below to a file with suffix <tt>.rules</tt> in the directory
7629ac
+    <tt>/etc/audit/rules.d</tt>.
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
7629ac
+    utility to read audit rules during daemon startup, add the rules below to
7629ac
+    <tt>/etc/audit/audit.rules</tt> file.
7629ac
+    
7629ac
+    -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
+    -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
+    
7629ac
+    If the system is 64 bit then also add the following lines:
7629ac
+    
7629ac
+    -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
+    -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
+    
7629ac
+
7629ac
+rationale: |-
7629ac
+    Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
7629ac
+    these events could serve as evidence of potential system compromise.
7629ac
+
7629ac
+severity: medium
7629ac
+
7629ac
+references:
7629ac
+    cis: 5.2.10
7629ac
+    cui: 3.1.7
7629ac
+    disa: 172,2884
7629ac
+    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
7629ac
+    nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
7629ac
+    ospp@rhel7: FAU_GEN.1.1.c
7629ac
+    pcidss: Req-10.2.4,Req-10.2.1
7629ac
+    srg: SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205,SRG-OS-000392-GPOS-00172
7629ac
+
7629ac
+{{{ complete_ocil_entry_audit_syscall(syscall="openat") }}}
7629ac
+
7629ac
+warnings:
7629ac
+    - general: |-
7629ac
+        Note that these rules can be configured in a
7629ac
+        number of ways while still achieving the desired effect. Here the system calls
7629ac
+        have been placed independent of other system calls. Grouping system calls related
7629ac
+        to the same event is more efficient. See the following example:
7629ac
+        
-a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_openat_o_trunc_write.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_openat_o_trunc_write.rule
7629ac
new file mode 100644
7629ac
index 0000000000..8ee69927d8
7629ac
--- /dev/null
7629ac
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_openat_o_trunc_write.rule
7629ac
@@ -0,0 +1,54 @@
7629ac
+documentation_complete: true
7629ac
+
7629ac
+prodtype: rhel7,fedora
7629ac
+
7629ac
+title: 'Record Unauthorized Modification Attempts to Files - openat O_TRUNC'
7629ac
+
7629ac
+description: |-
7629ac
+    The audit system should collect detailed unauthorized file accesses for
7629ac
+    all users and root. The <tt>openat</tt> syscall can be used to modify files
7629ac
+    if called for write operation of with O_TRUNC flag.
7629ac
+    The following auidt rules will asure that unsuccessful attempts to modify a
7629ac
+    file via <tt>openat</tt> syscall are collected.
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>augenrules</tt>
7629ac
+    program to read audit rules during daemon startup (the default), add the
7629ac
+    rules below to a file with suffix <tt>.rules</tt> in the directory
7629ac
+    <tt>/etc/audit/rules.d</tt>.
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
7629ac
+    utility to read audit rules during daemon startup, add the rules below to
7629ac
+    <tt>/etc/audit/audit.rules</tt> file.
7629ac
+    
7629ac
+    -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
+    -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
+    
7629ac
+    If the system is 64 bit then also add the following lines:
7629ac
+    
7629ac
+    -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
+    -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
+    
7629ac
+
7629ac
+rationale: |-
7629ac
+    Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
7629ac
+    these events could serve as evidence of potential system compromise.
7629ac
+
7629ac
+severity: medium
7629ac
+
7629ac
+references:
7629ac
+    cis: 5.2.10
7629ac
+    cui: 3.1.7
7629ac
+    disa: 172,2884
7629ac
+    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
7629ac
+    nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
7629ac
+    ospp@rhel7: FAU_GEN.1.1.c
7629ac
+    pcidss: Req-10.2.4,Req-10.2.1
7629ac
+    srg: SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205,SRG-OS-000392-GPOS-00172
7629ac
+
7629ac
+{{{ complete_ocil_entry_audit_syscall(syscall="openat") }}}
7629ac
+
7629ac
+warnings:
7629ac
+    - general: |-
7629ac
+        Note that these rules can be configured in a
7629ac
+        number of ways while still achieving the desired effect. Here the system calls
7629ac
+        have been placed independent of other system calls. Grouping system calls related
7629ac
+        to the same event is more efficient. See the following example:
7629ac
+        
-a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_openat_rule_order.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_openat_rule_order.rule
7629ac
new file mode 100644
7629ac
index 0000000000..d5849a46bf
7629ac
--- /dev/null
7629ac
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_unsuccessful_file_modification/audit_rules_unsuccessful_file_modification_openat_rule_order.rule
7629ac
@@ -0,0 +1,58 @@
7629ac
+documentation_complete: true
7629ac
+
7629ac
+prodtype: rhel7,fedora
7629ac
+
7629ac
+title: 'Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly'
7629ac
+
7629ac
+description: |-
7629ac
+    The audit system should collect detailed unauthorized file
7629ac
+    accesses for all users and root.
7629ac
+    To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access
7629ac
+    of files via <tt>openat</tt> syscall the audit rules collecting these events need to be in certain order.
7629ac
+    The more specific rules need to come before the less specific rules. The reason for that is that more
7629ac
+    specific rules cover a subset of events covered in the less specific rules, thus, they need to come
7629ac
+    before to not be overshadowed by less specific rules, which match a bigger set of events.
7629ac
+    Make sure that rules for unsuccessful calls of <tt>openat</tt> syscall are in the order shown below.
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>augenrules</tt>
7629ac
+    program to read audit rules during daemon startup (the default), check the order of
7629ac
+    rules below in a file with suffix <tt>.rules</tt> in the directory
7629ac
+    <tt>/etc/audit/rules.d</tt>.
7629ac
+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
7629ac
+    utility to read audit rules during daemon startup, check the order of rules below in
7629ac
+    <tt>/etc/audit/audit.rules</tt> file.
7629ac
+    
7629ac
+    -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
+    -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
+    -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
+    -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
+    -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
7629ac
+    -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
7629ac
+    
7629ac
+    If the system is 64 bit then also add the following lines:
7629ac
+    
7629ac
+    -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
+    -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
7629ac
+    -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
+    -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
7629ac
+    -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
7629ac
+    -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
7629ac
+    
7629ac
+
7629ac
+rationale: |-
7629ac
+    The more specific rules cover a subset of events covered by the less specific rules.
7629ac
+    By ordering them from more specific to less specific, it is assured that the less specific
7629ac
+    rule will not catch events better recorded by the more specific rule.
7629ac
+
7629ac
+severity: medium
7629ac
+
7629ac
+references:
7629ac
+    cis: 5.2.10
7629ac
+    cui: 3.1.7
7629ac
+    disa: 172,2884
7629ac
+    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
7629ac
+    nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
7629ac
+    ospp@rhel7: FAU_GEN.1.1.c
7629ac
+    pcidss: Req-10.2.4,Req-10.2.1
7629ac
+    srg: SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205,SRG-OS-000392-GPOS-00172
7629ac
+
7629ac
+{{{ complete_ocil_entry_audit_syscall(syscall="openat") }}}
7629ac
diff --git a/shared/templates/create_audit_rules_unsuccessful_file_modification_detailed.py b/shared/templates/create_audit_rules_unsuccessful_file_modification_detailed.py
7629ac
new file mode 100644
7629ac
index 0000000000..c14c35a381
7629ac
--- /dev/null
7629ac
+++ b/shared/templates/create_audit_rules_unsuccessful_file_modification_detailed.py
7629ac
@@ -0,0 +1,45 @@
7629ac
+#!/usr/bin/python2
7629ac
+
7629ac
+#
7629ac
+# create_audit_rules_unsuccessful_file_modification_detailed.py
7629ac
+#        generate template-based checks for unsuccessful file modifications detailed
7629ac
+#            - audit_rules_unsuccessful_file_modification_syscall_o_creat
7629ac
+#            - audit_rules_unsuccessful_file_modification_syscall_o_trunc_write
7629ac
+#            - audit_rules_unsuccessful_file_modification_syscall_rule_order
7629ac
+
7629ac
+
7629ac
+from template_common import FilesGenerator, UnknownTargetError
7629ac
+
7629ac
+import re
7629ac
+
7629ac
+class ARUFMDetailedGenerator(FilesGenerator):
7629ac
+    def generate(self, target, args):
7629ac
+        syscall = re.sub('[-\./]', '_', args[0])
7629ac
+        if target == "oval":
7629ac
+            self.file_from_template(
7629ac
+                "./template_OVAL_audit_rules_unsuccessful_file_modification_o_creat",
7629ac
+                {
7629ac
+                    "SYSCALL":	syscall
7629ac
+                },
7629ac
+                "./oval/audit_rules_unsuccessful_file_modification_{0}_o_creat.xml", syscall
7629ac
+            )
7629ac
+            self.file_from_template(
7629ac
+                "./template_OVAL_audit_rules_unsuccessful_file_modification_o_trunc_write",
7629ac
+                {
7629ac
+                    "SYSCALL":	syscall
7629ac
+                },
7629ac
+                "./oval/audit_rules_unsuccessful_file_modification_{0}_o_trunc_write.xml", syscall
7629ac
+            )
7629ac
+            self.file_from_template(
7629ac
+                "./template_OVAL_audit_rules_unsuccessful_file_modification_rule_order",
7629ac
+                {
7629ac
+                    "SYSCALL":	syscall
7629ac
+                },
7629ac
+                "./oval/audit_rules_unsuccessful_file_modification_{0}_rule_order.xml", syscall
7629ac
+            )
7629ac
+        else:
7629ac
+            raise UnknownTargetError(target)
7629ac
+
7629ac
+    def csv_format(self):
7629ac
+        return("CSV should contains lines of the format: " +
7629ac
+               "SYSCALL")
7629ac
diff --git a/shared/templates/csv/audit_rules_unsuccessful_file_modification_detailed.csv b/shared/templates/csv/audit_rules_unsuccessful_file_modification_detailed.csv
7629ac
new file mode 100644
7629ac
index 0000000000..97d5c04e14
7629ac
--- /dev/null
7629ac
+++ b/shared/templates/csv/audit_rules_unsuccessful_file_modification_detailed.csv
7629ac
@@ -0,0 +1,7 @@
7629ac
+# format:
7629ac
+# <syscall>
7629ac
+# - syscall is the syscall to generate detailed rules for
7629ac
+
7629ac
+open
7629ac
+openat
7629ac
+open_by_handle_at
7629ac
diff --git a/shared/templates/template_OVAL_audit_rules_unsuccessful_file_modification_o_creat b/shared/templates/template_OVAL_audit_rules_unsuccessful_file_modification_o_creat
7629ac
new file mode 100644
7629ac
index 0000000000..7f1bf6f68f
7629ac
--- /dev/null
7629ac
+++ b/shared/templates/template_OVAL_audit_rules_unsuccessful_file_modification_o_creat
7629ac
@@ -0,0 +1,200 @@
7629ac
+<def-group>
7629ac
+  <definition class="compliance" id="audit_rules_unsuccessful_file_modification_{{{ SYSCALL }}}_o_creat" version="1">
7629ac
+    <metadata>
7629ac
+      <title>Ensure auditd Collects Information on Unsuccesful Creation Attempts to Files - {{{ SYSCALL }}} o_creat</title>
7629ac
+      <affected family="unix">
7629ac
+        <platform>Red Hat Enterprise Linux 7</platform>
7629ac
+        <platform>multi_platform_fedora</platform>
7629ac
+      </affected>
7629ac
+      <description>Audit rules about the information on the unsuccessful use of {{{ SYSCALL }}} O_CREAT is enabled.</description>
7629ac
+    </metadata>
7629ac
+
7629ac
+    <criteria operator="OR">
7629ac
+
7629ac
+      
7629ac
+      <criteria operator="AND">
7629ac
+        <extend_definition comment="audit augenrules" definition_ref="audit_rules_augenrules" />
7629ac
+        <criterion comment="Verify audit rule {{{ SYSCALL }}} 32bit a2&0100 eacces augenrules exists" test_ref="test_arufm_{{{ SYSCALL }}}_o_creat_32bit_a20100_eacces_augenrules" />
7629ac
+        <criterion comment="Verify audit rule {{{ SYSCALL }}} 32bit a2&0100 eperm augenrules exists" test_ref="test_arufm_{{{ SYSCALL }}}_o_creat_32bit_a20100_eperm_augenrules" />
7629ac
+
7629ac
+        <criteria operator="OR">
7629ac
+          
7629ac
+          <extend_definition comment="64-bit system" definition_ref="system_info_architecture_64bit" negate="true" />
7629ac
+          
7629ac
+          <criteria operator="AND">
7629ac
+            <criterion comment="Verify audit rule {{{ SYSCALL }}} 64bit a2&0100 eacces augenrules exists" test_ref="test_arufm_{{{ SYSCALL }}}_o_creat_64bit_a20100_eacces_augenrules" />
7629ac
+            <criterion comment="Verify audit rule {{{ SYSCALL }}} 64bit a2&0100 eperm augenrules exists" test_ref="test_arufm_{{{ SYSCALL }}}_o_creat_64bit_a20100_eperm_augenrules" />
7629ac
+          </criteria>
7629ac
+        </criteria>
7629ac
+      </criteria>
7629ac
+
7629ac
+      
7629ac
+      <criteria operator="AND">
7629ac
+        <extend_definition comment="audit auditctl" definition_ref="audit_rules_auditctl" />
7629ac
+        <criterion comment="Verify audit rule {{{ SYSCALL }}} 32bit a2&0100 eacces auditctl exists" test_ref="test_arufm_{{{ SYSCALL }}}_o_creat_32bit_a20100_eacces_auditctl" />
7629ac
+        <criterion comment="Verify audit rule {{{ SYSCALL }}} 32bit a2&0100 eperm auditctl exists" test_ref="test_arufm_{{{ SYSCALL }}}_o_creat_32bit_a20100_eperm_auditctl" />
7629ac
+
7629ac
+        <criteria operator="OR">
7629ac
+          
7629ac
+          <extend_definition comment="64-bit_system" definition_ref="system_info_architecture_64bit" negate="true" />
7629ac
+          
7629ac
+          <criteria operator="AND">
7629ac
+            <criterion comment="Verify audit rule {{{ SYSCALL }}} 64bit a2&0100 eacces auditctl exists" test_ref="test_arufm_{{{ SYSCALL }}}_o_creat_64bit_a20100_eacces_auditctl" />
7629ac
+            <criterion comment="Verify audit rule {{{ SYSCALL }}} 64bit a2&0100 eperm auditctl exists" test_ref="test_arufm_{{{ SYSCALL }}}_o_creat_64bit_a20100_eperm_auditctl" />
7629ac
+
7629ac
+          </criteria>
7629ac
+        </criteria>
7629ac
+      </criteria>
7629ac
+
7629ac
+    </criteria>
7629ac
+  </definition>
7629ac
+
7629ac
+  
7629ac
+  <constant_variable id="var_audit_rule_{{{ SYSCALL }}}_o_creat_32bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
7629ac
+      <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S(?:[\s]+{{{ SYSCALL }}}[\s]+|(?:[\s]+|[,]){{{ SYSCALL }}}(?:[\s]+|[,])))[\S]*[\s]*</value>
7629ac
+  </constant_variable>
7629ac
+  <constant_variable id="var_audit_rule_{{{ SYSCALL }}}_o_creat_64bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
7629ac
+      <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S(?:[\s]+{{{ SYSCALL }}}[\s]+|(?:[\s]+|[,]){{{ SYSCALL }}}(?:[\s]+|[,])))[\S]*[\s]*</value>
7629ac
+  </constant_variable>
7629ac
+  <constant_variable id="var_audit_rule_{{{ SYSCALL }}}_o_creat_tail" version="1" datatype="string" comment="audit rule auid and key">
7629ac
+    <value>[\s]+(?:-F\s+auid>={{{ auid }}}[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
7629ac
+  </constant_variable>
7629ac
+
7629ac
+  
7629ac
+  <constant_variable id="var_audit_rule_{{{ SYSCALL }}}_o_creat_separator_regex" version="1" datatype="string" comment="audit rule auid and key">
7629ac
+    <value>(?:[^.]|\.\s)*</value>
7629ac
+  </constant_variable>
7629ac
+
7629ac
+  
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_o_creat_32bit_a20100_eacces_regex" version="1" datatype="string" comment="Expression to match 32bit {{{ SYSCALL }}} O_CREAT EACCES syscall">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_o_creat_32bit_head" />
7629ac
+      <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_o_creat_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+
7629ac
+  
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_o_creat_32bit_a20100_eperm_regex" version="1" datatype="string" comment="Expression to match 32bit {{{ SYSCALL }}} O_CREAT EPERM syscall">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_o_creat_32bit_head" />
7629ac
+      <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_o_creat_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+
7629ac
+  
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_o_creat_64bit_a20100_eacces_regex" version="1" datatype="string" comment="Expression to match 64bit {{{ SYSCALL }}} O_CREAT EACCES syscall">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_o_creat_64bit_head" />
7629ac
+      <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_o_creat_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+
7629ac
+  
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_o_creat_64bit_a20100_eperm_regex" version="1" datatype="string" comment="Expression to match 32bit {{{ SYSCALL }}} O_CREAT EPERM syscall">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_o_creat_64bit_head" />
7629ac
+      <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_o_creat_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_o_creat_32bit_a20100_eacces_augenrules" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_o_creat_32bit_a20100_eacces_augenrules" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_o_creat_32bit_a20100_eacces_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_o_creat_32bit_a20100_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_o_creat_32bit_a20100_eperm_augenrules" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_o_creat_32bit_a20100_eperm_augenrules" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_o_creat_32bit_a20100_eperm_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_o_creat_32bit_a20100_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_o_creat_64bit_a20100_eacces_augenrules" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_o_creat_64bit_a20100_eacces_augenrules" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_o_creat_64bit_a20100_eacces_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_o_creat_64bit_a20100_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_o_creat_64bit_a20100_eperm_augenrules" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_o_creat_64bit_a20100_eperm_augenrules" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_o_creat_64bit_a20100_eperm_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_o_creat_64bit_a20100_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_o_creat_32bit_a20100_eacces_auditctl" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_o_creat_32bit_a20100_eacces_auditctl" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_o_creat_32bit_a20100_eacces_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_o_creat_32bit_a20100_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_o_creat_32bit_a20100_eperm_auditctl" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_o_creat_32bit_a20100_eperm_auditctl" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_o_creat_32bit_a20100_eperm_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_o_creat_32bit_a20100_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_o_creat_64bit_a20100_eacces_auditctl" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_o_creat_64bit_a20100_eacces_auditctl" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_o_creat_64bit_a20100_eacces_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_o_creat_64bit_a20100_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_o_creat_64bit_a20100_eperm_auditctl" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_o_creat_64bit_a20100_eperm_auditctl" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_o_creat_64bit_a20100_eperm_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_o_creat_64bit_a20100_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+</def-group>
7629ac
diff --git a/shared/templates/template_OVAL_audit_rules_unsuccessful_file_modification_o_trunc_write b/shared/templates/template_OVAL_audit_rules_unsuccessful_file_modification_o_trunc_write
7629ac
new file mode 100644
7629ac
index 0000000000..ce7d3c44c7
7629ac
--- /dev/null
7629ac
+++ b/shared/templates/template_OVAL_audit_rules_unsuccessful_file_modification_o_trunc_write
7629ac
@@ -0,0 +1,200 @@
7629ac
+<def-group>
7629ac
+  <definition class="compliance" id="audit_rules_unsuccessful_file_modification_{{{ SYSCALL }}}_o_trunc_write" version="1">
7629ac
+    <metadata>
7629ac
+      <title>Ensure auditd Collects Information on Unsuccesful Creation Attempts to Files - {{{ SYSCALL }}} o_trunc</title>
7629ac
+      <affected family="unix">
7629ac
+        <platform>Red Hat Enterprise Linux 7</platform>
7629ac
+        <platform>multi_platform_fedora</platform>
7629ac
+      </affected>
7629ac
+      <description>Audit rules about the information on the unsuccessful use of {{{ SYSCALL }}} O_TRUNC is enabled.</description>
7629ac
+    </metadata>
7629ac
+
7629ac
+    <criteria operator="OR">
7629ac
+
7629ac
+      
7629ac
+      <criteria operator="AND">
7629ac
+        <extend_definition comment="audit augenrules" definition_ref="audit_rules_augenrules" />
7629ac
+        <criterion comment="Verify audit rule {{{ SYSCALL }}} 32bit a2&01003 eacces augenrules exists" test_ref="test_arufm_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eacces_augenrules" />
7629ac
+        <criterion comment="Verify audit rule {{{ SYSCALL }}} 32bit a2&01003 eperm augenrules exists" test_ref="test_arufm_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eperm_augenrules" />
7629ac
+
7629ac
+        <criteria operator="OR">
7629ac
+          
7629ac
+          <extend_definition comment="64-bit system" definition_ref="system_info_architecture_64bit" negate="true" />
7629ac
+          
7629ac
+          <criteria operator="AND">
7629ac
+            <criterion comment="Verify audit rule {{{ SYSCALL }}} 64bit a2&01003 eacces augenrules exists" test_ref="test_arufm_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eacces_augenrules" />
7629ac
+            <criterion comment="Verify audit rule {{{ SYSCALL }}} 64bit a2&01003 eperm augenrules exists" test_ref="test_arufm_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eperm_augenrules" />
7629ac
+          </criteria>
7629ac
+        </criteria>
7629ac
+      </criteria>
7629ac
+
7629ac
+      
7629ac
+      <criteria operator="AND">
7629ac
+        <extend_definition comment="audit auditctl" definition_ref="audit_rules_auditctl" />
7629ac
+        <criterion comment="Verify audit rule {{{ SYSCALL }}} 32bit a2&01003 eacces auditctl exists" test_ref="test_arufm_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eacces_auditctl" />
7629ac
+        <criterion comment="Verify audit rule {{{ SYSCALL }}} 32bit a2&01003 eperm auditctl exists" test_ref="test_arufm_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eperm_auditctl" />
7629ac
+
7629ac
+        <criteria operator="OR">
7629ac
+          
7629ac
+          <extend_definition comment="64-bit_system" definition_ref="system_info_architecture_64bit" negate="true" />
7629ac
+          
7629ac
+          <criteria operator="AND">
7629ac
+            <criterion comment="Verify audit rule {{{ SYSCALL }}} 64bit a2&01003 eacces auditctl exists" test_ref="test_arufm_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eacces_auditctl" />
7629ac
+            <criterion comment="Verify audit rule {{{ SYSCALL }}} 64bit a2&01003 eperm auditctl exists" test_ref="test_arufm_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eperm_auditctl" />
7629ac
+
7629ac
+          </criteria>
7629ac
+        </criteria>
7629ac
+      </criteria>
7629ac
+
7629ac
+    </criteria>
7629ac
+  </definition>
7629ac
+
7629ac
+  
7629ac
+  <constant_variable id="var_audit_rule_{{{ SYSCALL }}}_o_trunc_32bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
7629ac
+      <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S(?:[\s]+{{{ SYSCALL }}}[\s]+|(?:[\s]+|[,]){{{ SYSCALL }}}(?:[\s]+|[,])))[\S]*[\s]*</value>
7629ac
+  </constant_variable>
7629ac
+  <constant_variable id="var_audit_rule_{{{ SYSCALL }}}_o_trunc_64bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
7629ac
+      <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S(?:[\s]+{{{ SYSCALL }}}[\s]+|(?:[\s]+|[,]){{{ SYSCALL }}}(?:[\s]+|[,])))[\S]*[\s]*</value>
7629ac
+  </constant_variable>
7629ac
+  <constant_variable id="var_audit_rule_{{{ SYSCALL }}}_o_trunc_tail" version="1" datatype="string" comment="audit rule auid and key">
7629ac
+    <value>[\s]+(?:-F\s+auid>={{{ auid }}}[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
7629ac
+  </constant_variable>
7629ac
+
7629ac
+  
7629ac
+  <constant_variable id="var_audit_rule_{{{ SYSCALL }}}_o_trunc_separator_regex" version="1" datatype="string" comment="audit rule auid and key">
7629ac
+    <value>(?:[^.]|\.\s)*</value>
7629ac
+  </constant_variable>
7629ac
+
7629ac
+  
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eacces_regex" version="1" datatype="string" comment="Expression to match 32bit {{{ SYSCALL }}} O_TRUNC EACCES syscall">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_o_trunc_32bit_head" />
7629ac
+      <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_o_trunc_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+
7629ac
+  
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eperm_regex" version="1" datatype="string" comment="Expression to match 32bit {{{ SYSCALL }}} O_TRUNC EPERM EACCES syscall">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_o_trunc_32bit_head" />
7629ac
+      <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_o_trunc_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+
7629ac
+  
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eacces_regex" version="1" datatype="string" comment="Expression to match 64bit {{{ SYSCALL }}} O_TRUNC EACCES syscall">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_o_trunc_64bit_head" />
7629ac
+      <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_o_trunc_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+
7629ac
+  
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eperm_regex" version="1" datatype="string" comment="Expression to match 64bit {{{ SYSCALL }}} O_TRUNC EPERM syscall">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_o_trunc_64bit_head" />
7629ac
+      <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_o_trunc_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eacces_augenrules" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eacces_augenrules" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eacces_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eperm_augenrules" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eperm_augenrules" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eperm_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eacces_augenrules" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eacces_augenrules" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eacces_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eperm_augenrules" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eperm_augenrules" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eperm_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eacces_auditctl" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eacces_auditctl" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eacces_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eperm_auditctl" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eperm_auditctl" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eperm_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_o_trunc_32bit_a201003_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eacces_auditctl" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eacces_auditctl" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eacces_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eperm_auditctl" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eperm_auditctl" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eperm_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_o_trunc_64bit_a201003_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+</def-group>
7629ac
diff --git a/shared/templates/template_OVAL_audit_rules_unsuccessful_file_modification_rule_order b/shared/templates/template_OVAL_audit_rules_unsuccessful_file_modification_rule_order
7629ac
new file mode 100644
7629ac
index 0000000000..66a8ecf249
7629ac
--- /dev/null
7629ac
+++ b/shared/templates/template_OVAL_audit_rules_unsuccessful_file_modification_rule_order
7629ac
@@ -0,0 +1,474 @@
7629ac
+<def-group>
7629ac
+  <definition class="compliance" id="audit_rules_unsuccessful_file_modification_{{{ SYSCALL }}}_rule_order" version="1">
7629ac
+    <metadata>
7629ac
+      <title>Ensure auditd Rules For Unauthorized Attempts To {{{ SYSCALL }}} Are Ordered Correctly</title>
7629ac
+      <affected family="unix">
7629ac
+        <platform>Red Hat Enterprise Linux 7</platform>
7629ac
+        <platform>multi_platform_fedora</platform>
7629ac
+      </affected>
7629ac
+      <description>Audit rules about the information on the unsuccessful use of {{{ SYSCALL }}} is configured in the proper rule order.</description>
7629ac
+
7629ac
+    </metadata>
7629ac
+
7629ac
+    <criteria operator="OR">
7629ac
+
7629ac
+      
7629ac
+      <criteria operator="AND">
7629ac
+        <extend_definition comment="audit augenrules" definition_ref="audit_rules_augenrules" />
7629ac
+        <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_{{{ SYSCALL }}}_order_32bit_eacces_augenrules" />
7629ac
+        <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_{{{ SYSCALL }}}_order_32bit_eperm_augenrules" />
7629ac
+
7629ac
+        <criteria operator="OR">
7629ac
+          
7629ac
+          <extend_definition comment="64-bit system" definition_ref="system_info_architecture_64bit" negate="true" />
7629ac
+          
7629ac
+          <criteria operator="AND">
7629ac
+            <criterion comment="audit augenrules 64-bit" test_ref="test_arufm_{{{ SYSCALL }}}_order_64bit_eacces_augenrules" />
7629ac
+            <criterion comment="audit augenrules 64-bit" test_ref="test_arufm_{{{ SYSCALL }}}_order_64bit_eperm_augenrules" />
7629ac
+          </criteria>
7629ac
+        </criteria>
7629ac
+      </criteria>
7629ac
+
7629ac
+      
7629ac
+      <criteria operator="AND">
7629ac
+        <extend_definition comment="audit auditctl" definition_ref="audit_rules_auditctl" />
7629ac
+        <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_{{{ SYSCALL }}}_order_32bit_eacces_auditctl" />
7629ac
+        <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_{{{ SYSCALL }}}_order_32bit_eperm_auditctl" />
7629ac
+
7629ac
+        <criteria operator="OR">
7629ac
+          
7629ac
+          <extend_definition comment="64-bit_system" definition_ref="system_info_architecture_64bit" negate="true" />
7629ac
+          
7629ac
+          <criteria operator="AND">
7629ac
+            <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_{{{ SYSCALL }}}_order_64bit_eacces_auditctl" />
7629ac
+            <criterion comment="audit augenrules 32-bit" test_ref="test_arufm_{{{ SYSCALL }}}_order_64bit_eperm_auditctl" />
7629ac
+
7629ac
+          </criteria>
7629ac
+        </criteria>
7629ac
+      </criteria>
7629ac
+
7629ac
+    </criteria>
7629ac
+  </definition>
7629ac
+
7629ac
+  
7629ac
+  <constant_variable id="var_audit_rule_{{{ SYSCALL }}}_order_32bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
7629ac
+      <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S(?:[\s]+{{{ SYSCALL }}}[\s]+|(?:[\s]+|[,]){{{ SYSCALL }}}(?:[\s]+|[,])))[\S]*[\s]*</value>
7629ac
+  </constant_variable>
7629ac
+  <constant_variable id="var_audit_rule_{{{ SYSCALL }}}_order_64bit_head" version="1" datatype="string" comment="audit rule arch and syscal">
7629ac
+      <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S(?:[\s]+{{{ SYSCALL }}}[\s]+|(?:[\s]+|[,]){{{ SYSCALL }}}(?:[\s]+|[,])))[\S]*[\s]*</value>
7629ac
+  </constant_variable>
7629ac
+  <constant_variable id="var_audit_rule_{{{ SYSCALL }}}_order_tail" version="1" datatype="string" comment="audit rule auid and key">
7629ac
+    <value>[\s]+(?:-F\s+auid>={{{ auid }}}[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
7629ac
+  </constant_variable>
7629ac
+
7629ac
+  
7629ac
+  <constant_variable id="var_audit_rule_{{{ SYSCALL }}}_order_separator_regex" version="1" datatype="string" comment="audit rule auid and key">
7629ac
+    <value>(?:[^.]|\.\s)*</value>
7629ac
+  </constant_variable>
7629ac
+
7629ac
+  
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_order_32bit_a20100_eacces_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_head" />
7629ac
+      <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_order_32bit_a201003_eacces_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_head" />
7629ac
+      <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_order_32bit_eacces_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_head" />
7629ac
+      <literal_component>(?!.*-F\s+a2&)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+
7629ac
+  
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_order_32bit_a20100_eperm_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_head" />
7629ac
+      <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_order_32bit_a201003_eperm_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_head" />
7629ac
+      <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_order_32bit_eperm_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_head" />
7629ac
+      <literal_component>(?!.*-F\s+a2&)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+
7629ac
+  
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_order_64bit_a20100_eacces_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_head" />
7629ac
+      <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_order_64bit_a201003_eacces_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_head" />
7629ac
+      <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_order_64bit_eacces_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_head" />
7629ac
+      <literal_component>(?!.*-F\s+a2&)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+
7629ac
+  
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_order_64bit_a20100_eperm_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_head" />
7629ac
+      <literal_component>(?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_order_64bit_a201003_eperm_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_head" />
7629ac
+      <literal_component>(?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+  <local_variable id="var_audit_rule_{{{ SYSCALL }}}_order_64bit_eperm_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_head" />
7629ac
+      <literal_component>(?!.*-F\s+a2&)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_tail" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_32bit_a20100_eacces_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_a20100_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_32bit_a201003_eacces_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_a201003_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_nofilter_32bit_eacces_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <local_variable id="var_arufm_rule_order_32bit_{{{ SYSCALL }}}_eacces_augenrules_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_32bit_a20100_eacces_augenrules" />
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_separator_regex" />
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_32bit_a201003_eacces_augenrules" />
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_separator_regex" />
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_nofilter_32bit_eacces_augenrules" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_order_32bit_eacces_augenrules" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_order_32bit_eacces_augenrules" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_32bit_eacces_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_arufm_rule_order_32bit_{{{ SYSCALL }}}_eacces_augenrules_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_32bit_a20100_eperm_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_a20100_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_32bit_a201003_eperm_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_a201003_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_nofilter_32bit_eperm_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <local_variable id="var_arufm_rule_order_32bit_{{{ SYSCALL }}}_eperm_augenrules_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_32bit_a20100_eperm_augenrules" />
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_separator_regex" />
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_32bit_a201003_eperm_augenrules" />
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_separator_regex" />
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_nofilter_32bit_eperm_augenrules" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_order_32bit_eperm_augenrules" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_order_32bit_eperm_augenrules" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_32bit_eperm_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_arufm_rule_order_32bit_{{{ SYSCALL }}}_eperm_augenrules_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_64bit_a20100_eacces_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_a20100_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_64bit_a201003_eacces_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_a201003_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_nofilter_64bit_eacces_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <local_variable id="var_arufm_rule_order_64bit_{{{ SYSCALL }}}_eacces_augenrules_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_64bit_a20100_eacces_augenrules" />
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_separator_regex" />
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_64bit_a201003_eacces_augenrules" />
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_separator_regex" />
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_nofilter_64bit_eacces_augenrules" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_order_64bit_eacces_augenrules" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_order_64bit_eacces_augenrules" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_64bit_eacces_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_arufm_rule_order_64bit_{{{ SYSCALL }}}_eacces_augenrules_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_64bit_a20100_eperm_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_a20100_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_64bit_a201003_eperm_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_a201003_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_nofilter_64bit_eperm_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <local_variable id="var_arufm_rule_order_64bit_{{{ SYSCALL }}}_eperm_augenrules_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_64bit_a20100_eperm_augenrules" />
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_separator_regex" />
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_64bit_a201003_eperm_augenrules" />
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_separator_regex" />
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_nofilter_64bit_eperm_augenrules" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_order_64bit_eperm_augenrules" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_order_64bit_eperm_augenrules" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_64bit_eperm_augenrules" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_arufm_rule_order_64bit_{{{ SYSCALL }}}_eperm_augenrules_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_32bit_a20100_eacces_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_a20100_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_32bit_a201003_eacces_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_a201003_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_nofilter_32bit_eacces_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <local_variable id="var_arufm_rule_order_32bit_{{{ SYSCALL }}}_auditctl_eacces_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_32bit_a20100_eacces_auditctl" />
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_separator_regex" />
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_32bit_a201003_eacces_auditctl" />
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_separator_regex" />
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_nofilter_32bit_eacces_auditctl" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_order_32bit_eacces_auditctl" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_order_32bit_eacces_auditctl" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_32bit_eacces_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_arufm_rule_order_32bit_{{{ SYSCALL }}}_auditctl_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_32bit_a20100_eperm_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_a20100_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_32bit_a201003_eperm_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_a201003_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_nofilter_32bit_eperm_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_32bit_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  
7629ac
+  <local_variable id="var_arufm_rule_order_32bit_{{{ SYSCALL }}}_auditctl_eperm_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_32bit_a20100_eperm_auditctl" />
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_separator_regex" />
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_32bit_a201003_eperm_auditctl" />
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_separator_regex" />
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_nofilter_32bit_eperm_auditctl" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+  
7629ac
+ comment="Test order of audit 32bit auditctl eperm rules order" id="test_arufm_{{{ SYSCALL }}}_order_32bit_eperm_auditctl" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_order_32bit_eperm_auditctl" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_32bit_eperm_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_arufm_rule_order_32bit_{{{ SYSCALL }}}_auditctl_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_64bit_a20100_eacces_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_a20100_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_64bit_a201003_eacces_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_a201003_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_nofilter_64bit_eacces_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <local_variable id="var_arufm_{{{ SYSCALL }}}_order_64bit_auditctl_eacces_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_64bit_a20100_eacces_auditctl" />
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_separator_regex" />
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_64bit_a201003_eacces_auditctl" />
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_separator_regex" />
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_nofilter_64bit_eacces_auditctl" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_order_64bit_eacces_auditctl" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_order_64bit_eacces_auditctl" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_64bit_eacces_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_arufm_{{{ SYSCALL }}}_order_64bit_auditctl_eacces_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+
7629ac
+  
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_64bit_a20100_eperm_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_a20100_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_64bit_a201003_eperm_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_a201003_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_nofilter_64bit_eperm_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_audit_rule_{{{ SYSCALL }}}_order_64bit_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+  <local_variable id="var_arufm_rule_order_64bit_{{{ SYSCALL }}}_auditctl_eperm_regex" version="1" datatype="string" comment="arches to audit">
7629ac
+    <concat>
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_64bit_a20100_eperm_auditctl" />
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_separator_regex" />
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_64bit_a201003_eperm_auditctl" />
7629ac
+      <variable_component var_ref="var_audit_rule_{{{ SYSCALL }}}_order_separator_regex" />
7629ac
+      <object_component item_field="text" object_ref="object_arufm_{{{ SYSCALL }}}_order_nofilter_64bit_eperm_auditctl" />
7629ac
+    </concat>
7629ac
+  </local_variable>
7629ac
+  
7629ac
+ comment="defined audit rule must exist" id="test_arufm_{{{ SYSCALL }}}_order_64bit_eperm_auditctl" version="1">
7629ac
+    <ind:object object_ref="object_arufm_{{{ SYSCALL }}}_order_64bit_eperm_auditctl" />
7629ac
+  </ind:textfilecontent54_test>
7629ac
+  <ind:textfilecontent54_object id="object_arufm_{{{ SYSCALL }}}_order_64bit_eperm_auditctl" version="1">
7629ac
+    <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
7629ac
+    <ind:pattern operation="pattern match" var_ref="var_arufm_rule_order_64bit_{{{ SYSCALL }}}_auditctl_eperm_regex" />
7629ac
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
7629ac
+  </ind:textfilecontent54_object>
7629ac
+
7629ac
+</def-group>
7629ac
diff --git a/ssg/build_templates.py b/ssg/build_templates.py
7629ac
index 8c6a18843e..964f6802e3 100644
7629ac
--- a/ssg/build_templates.py
7629ac
+++ b/ssg/build_templates.py
7629ac
@@ -21,6 +21,7 @@
7629ac
 from create_sysctl import SysctlGenerator
7629ac
 from create_audit_rules_dac_modification import AuditRulesDacModificationGenerator
7629ac
 from create_audit_rules_unsuccessful_file_modification import AuditRulesUnsuccessfulFileModificationGenerator
7629ac
+from create_audit_rules_unsuccessful_file_modification_detailed import ARUFMDetailedGenerator
7629ac
 from create_audit_rules_file_deletion_events import AuditRulesFileDeletionEventsGenerator
7629ac
 from create_audit_rules_login_events import AuditRulesLoginEventsGenerator
7629ac
 from create_audit_rules_privileged_commands import AuditRulesPrivilegedCommandsGenerator
7629ac
@@ -64,10 +65,12 @@ def __init__(self, env_yaml):
7629ac
             "selinux_booleans.csv":             SEBoolGenerator(),
7629ac
             "audit_rules_dac_modification.csv": AuditRulesDacModificationGenerator(),
7629ac
             "audit_rules_unsuccessful_file_modification.csv":   AuditRulesUnsuccessfulFileModificationGenerator(),
7629ac
+            "audit_rules_unsuccessful_file_modification_detailed.csv":   ARUFMDetailedGenerator(),
7629ac
             "audit_rules_file_deletion_events.csv":  AuditRulesFileDeletionEventsGenerator(),
7629ac
             "audit_rules_login_events.csv":  AuditRulesLoginEventsGenerator(),
7629ac
             "audit_rules_privileged_commands.csv":  AuditRulesPrivilegedCommandsGenerator(),
7629ac
             "audit_rules_usergroup_modification.csv":  AuditRulesUserGroupModificationGenerator(),
7629ac
+            "audit_rules_usergroup_modification.csv":  AuditRulesUserGroupModificationGenerator(),
7629ac
             "audit_rules_execution.csv":        AuditRulesExecutionGenerator(),
7629ac
         }
7629ac
         self.langs = TEMPLATED_LANGUAGES