|
 |
76240a |
From 01397cbe2a62303ef001ab5e5821ffafd6929e41 Mon Sep 17 00:00:00 2001
|
|
|
76240a |
From: Alex Haydock <alex@alexhaydock.co.uk>
|
|
|
76240a |
Date: Fri, 6 Aug 2021 16:46:22 +0100
|
|
|
76240a |
Subject: [PATCH] Update CCEs and identifiers on rules that make up RHEL 8 CIS
|
|
|
76240a |
4.1.15
|
|
|
76240a |
|
|
|
76240a |
---
|
|
|
76240a |
.../audit_rules_privileged_commands_insmod/rule.yml | 2 ++
|
|
|
76240a |
.../audit_rules_privileged_commands_modprobe/rule.yml | 2 ++
|
|
|
76240a |
.../audit_rules_privileged_commands_rmmod/rule.yml | 2 ++
|
|
|
76240a |
shared/references/cce-redhat-avail.txt | 3 ---
|
|
|
76240a |
4 files changed, 6 insertions(+), 3 deletions(-)
|
|
|
76240a |
|
|
|
76240a |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/rule.yml
|
|
|
76240a |
index 5c3a99447c..a4ecb0d1e0 100644
|
|
|
76240a |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/rule.yml
|
|
|
76240a |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/rule.yml
|
|
|
76240a |
@@ -28,10 +28,12 @@ severity: medium
|
|
|
76240a |
|
|
|
76240a |
identifiers:
|
|
|
76240a |
cce@rhel7: CCE-85851-4
|
|
|
76240a |
+ cce@rhel8: CCE-85919-9
|
|
|
76240a |
cce@sle15: CCE-85744-1
|
|
|
76240a |
|
|
|
76240a |
references:
|
|
|
76240a |
cis@rhel7: 4.1.16
|
|
|
76240a |
+ cis@rhel8: 4.1.15
|
|
|
76240a |
cis@ubuntu2004: 4.1.16
|
|
|
76240a |
disa: CCI-000130,CCI-000169,CCI-000172,CCI-002884
|
|
|
76240a |
nist: AU-12(c),AU-12.1(iv),AU-3,AU-3.1,AU-12(a),AU-12.1(ii),MA-4(1)(a)
|
|
|
76240a |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/rule.yml
|
|
|
76240a |
index 5e03dde851..f70c537064 100644
|
|
|
76240a |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/rule.yml
|
|
|
76240a |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/rule.yml
|
|
|
76240a |
@@ -32,10 +32,12 @@ severity: medium
|
|
|
76240a |
|
|
|
76240a |
identifiers:
|
|
|
76240a |
cce@rhel7: CCE-85853-0
|
|
|
76240a |
+ cce@rhel8: CCE-85973-6
|
|
|
76240a |
cce@sle15: CCE-85731-8
|
|
|
76240a |
|
|
|
76240a |
references:
|
|
|
76240a |
cis@rhel7: 4.1.16
|
|
|
76240a |
+ cis@rhel8: 4.1.15
|
|
|
76240a |
cis@ubuntu2004: 4.1.16
|
|
|
76240a |
disa: CCI-000130,CCI-000169,CCI-000172,CCI-002884
|
|
|
76240a |
nist: AU-12(a),AU-12.1(ii),AU-3,AU-3.1,AU-12(c),AU-12.1(iv),MA-4(1)(a)
|
|
|
76240a |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/rule.yml
|
|
|
76240a |
index 1535041672..113c8fc4bc 100644
|
|
|
76240a |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/rule.yml
|
|
|
76240a |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/rule.yml
|
|
|
76240a |
@@ -28,10 +28,12 @@ severity: medium
|
|
|
76240a |
|
|
|
76240a |
identifiers:
|
|
|
76240a |
cce@rhel7: CCE-85852-2
|
|
|
76240a |
+ cce@rhel8: CCE-86017-1
|
|
|
76240a |
cce@sle15: CCE-85732-6
|
|
|
76240a |
|
|
|
76240a |
references:
|
|
|
76240a |
cis@rhel7: 4.1.16
|
|
|
76240a |
+ cis@rhel8: 4.1.15
|
|
|
76240a |
cis@ubuntu2004: 4.1.16
|
|
|
76240a |
disa: CCI-000130,CCI-000169,CCI-000172,CCI-002884
|
|
|
76240a |
nist@sle15: AU-12(c),AU-12.1(iv),AU-3,AU-3.1,AU-12(a),AU-12.1(ii),MA-4(1)(a)
|
|
|
76240a |
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
|
|
|
76240a |
index 001262c6ee..aaa631515b 100644
|
|
|
76240a |
--- a/shared/references/cce-redhat-avail.txt
|
|
|
76240a |
+++ b/shared/references/cce-redhat-avail.txt
|
|
|
76240a |
@@ -49,7 +49,6 @@ CCE-85915-7
|
|
|
76240a |
CCE-85916-5
|
|
|
76240a |
CCE-85917-3
|
|
|
76240a |
CCE-85918-1
|
|
|
76240a |
-CCE-85919-9
|
|
|
76240a |
CCE-85920-7
|
|
|
76240a |
CCE-85921-5
|
|
|
76240a |
CCE-85922-3
|
|
|
76240a |
@@ -100,7 +99,6 @@ CCE-85968-6
|
|
|
76240a |
CCE-85969-4
|
|
|
76240a |
CCE-85970-2
|
|
|
76240a |
CCE-85972-8
|
|
|
76240a |
-CCE-85973-6
|
|
|
76240a |
CCE-85974-4
|
|
|
76240a |
CCE-85975-1
|
|
|
76240a |
CCE-85976-9
|
|
|
76240a |
@@ -143,7 +141,6 @@ CCE-86013-0
|
|
|
76240a |
CCE-86014-8
|
|
|
76240a |
CCE-86015-5
|
|
|
76240a |
CCE-86016-3
|
|
|
76240a |
-CCE-86017-1
|
|
|
76240a |
CCE-86018-9
|
|
|
76240a |
CCE-86019-7
|
|
|
76240a |
CCE-86020-5
|