From 25dcc59ebea297789ee89cfe0263ec8575455da7 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Thu, 26 Nov 2020 15:45:10 +0100
Subject: [PATCH 1/2] Update RHEL7 STIG profile with /var/log/audit related
rules.
Add file_permissions_var_log_audit and file_ownership_var_log_audit to
RHEL7 STIG profile.
---
.../file_ownership_var_log_audit/rule.yml | 1 +
.../file_permissions_var_log_audit/oval/shared.xml | 2 +-
.../file_permissions_var_log_audit/rule.yml | 1 +
rhel7/profiles/stig.profile | 2 ++
4 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit/rule.yml
index 248ff3598..8a8c71520 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit/rule.yml
@@ -21,6 +21,7 @@ identifiers:
references:
stigid@ol7: OL07-00-910055
+ stigid@rhel7: RHEL-07-910055
stigid@rhel6: RHEL-06-000384
srg@rhel6: SRG-OS-000057
disa@rhel6: CCI-000166
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/oval/shared.xml b/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/oval/shared.xml
index 5941ea660f..1bb7dd453c 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/oval/shared.xml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/oval/shared.xml
@@ -34,7 +34,7 @@
</unix:file_object>
<unix:file_state id="state_not_mode_0600" version="1" operator="OR">
- <!-- if any one of these is true then mode is NOT 0640 (hence the OR operator) -->
+ <!-- if any one of these is true then mode is NOT 0600 (hence the OR operator) -->
<unix:suid datatype="boolean">true</unix:suid>
<unix:sgid datatype="boolean">true</unix:sgid>
<unix:sticky datatype="boolean">true</unix:sticky>
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml
index 6c265d68b..d6b36b647 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml
@@ -24,6 +24,7 @@ identifiers:
references:
stigid@ol7: OL07-00-910055
+ stigid@rhel7: RHEL-07-910055
disa: CCI-000162,CCI-000163,CCI-000164,CCI-001314
srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000206-GPOS-00084
stigid@rhel6: RHEL-06-000383
diff --git a/rhel7/profiles/stig.profile b/rhel7/profiles/stig.profile
index 4698785a49..1d94e79964 100644
--- a/rhel7/profiles/stig.profile
+++ b/rhel7/profiles/stig.profile
@@ -313,3 +313,5 @@ selections:
- mount_option_dev_shm_nosuid
- audit_rules_privileged_commands_mount
- package_MFEhiplsm_installed
+ - file_ownership_var_log_audit
+ - file_permissions_var_log_audit
From e83eaf0ff5a3e3a4cb7a3caac0410c4ad4813312 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Thu, 26 Nov 2020 15:57:29 +0100
Subject: [PATCH 2/2] Remove unrelated fix content from
file_permissions_var_log_audit bash.
---
.../file_permissions_var_log_audit/bash/shared.sh | 5 -----
1 file changed, 5 deletions(-)
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/bash/shared.sh
index 3175a18a23..d6c45867e5 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/bash/shared.sh
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/bash/shared.sh
@@ -9,12 +9,7 @@ if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
chmod 0600 /var/log/audit/audit.log
chmod 0400 /var/log/audit/audit.log.*
fi
-
- chmod 0640 /etc/audit/audit*
- chmod 0640 /etc/audit/rules.d/*
else
chmod 0600 /var/log/audit/audit.log
chmod 0400 /var/log/audit/audit.log.*
- chmod 0640 /etc/audit/audit*
- chmod 0640 /etc/audit/rules.d/*
fi