|
 |
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml
|
|
|
12e95e |
index a0b3efcbf79..1bc7afbb224 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml
|
|
|
12e95e |
@@ -58,7 +58,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030410
|
|
|
12e95e |
stigid@ol8: OL08-00-030540
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030420
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030540
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030490
|
|
|
12e95e |
stigid@sle12: SLES-12-020470
|
|
|
12e95e |
stigid@sle15: SLES-15-030300
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010153
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml
|
|
|
12e95e |
index 83dd57f2b6d..dc8211684f2 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml
|
|
|
12e95e |
@@ -58,7 +58,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030410
|
|
|
12e95e |
stigid@ol8: OL08-00-030530
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030430
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030530
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030490
|
|
|
12e95e |
stigid@sle12: SLES-12-020480
|
|
|
12e95e |
stigid@sle15: SLES-15-030310
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010154
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml
|
|
|
12e95e |
index 1b78aab4a1a..07592bb2fd9 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml
|
|
|
12e95e |
@@ -61,7 +61,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030370
|
|
|
12e95e |
stigid@ol8: OL08-00-030520
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030380
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030520
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030480
|
|
|
12e95e |
stigid@sle12: SLES-12-020430
|
|
|
12e95e |
stigid@sle15: SLES-15-030260
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010149
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml
|
|
|
12e95e |
index 360c60de06d..084970765b2 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml
|
|
|
12e95e |
@@ -58,7 +58,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030370
|
|
|
12e95e |
stigid@ol8: OL08-00-030510
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030400
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030510
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030480
|
|
|
12e95e |
stigid@sle12: SLES-12-020450
|
|
|
12e95e |
stigid@sle15: SLES-15-030280
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010150
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml
|
|
|
12e95e |
index 19bf8a5b981..5695440ad7d 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml
|
|
|
12e95e |
@@ -75,7 +75,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030440
|
|
|
12e95e |
stigid@ol8: OL08-00-030240
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030480
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030240
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030200
|
|
|
12e95e |
stigid@sle12: SLES-12-020410
|
|
|
12e95e |
stigid@sle15: SLES-15-030210
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010147
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml
|
|
|
12e95e |
index 40cd114042e..ab536a8ae0a 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml
|
|
|
12e95e |
@@ -70,7 +70,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030440
|
|
|
12e95e |
stigid@ol8: OL08-00-030230
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030450
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030230
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030200
|
|
|
12e95e |
stigid@sle12: SLES-12-020380
|
|
|
12e95e |
stigid@sle15: SLES-15-030230
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010144
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml
|
|
|
12e95e |
index 81dddd9fb71..d1f4ee35ccb 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml
|
|
|
12e95e |
@@ -58,7 +58,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030370
|
|
|
12e95e |
stigid@ol8: OL08-00-030500
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030390
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030500
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030480
|
|
|
12e95e |
stigid@sle12: SLES-12-020440
|
|
|
12e95e |
stigid@sle15: SLES-15-030270
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010151
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml
|
|
|
12e95e |
index fa15012b05f..a2425e373bc 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml
|
|
|
12e95e |
@@ -69,7 +69,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030440
|
|
|
12e95e |
stigid@ol8: OL08-00-030220
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030460
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030220
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030200
|
|
|
12e95e |
stigid@sle15: SLES-15-030240
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010143
|
|
|
12e95e |
vmmsrg: SRG-OS-000458-VMM-001810,SRG-OS-000474-VMM-001940
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml
|
|
|
12e95e |
index 6d15eecee2c..0be27fbe860 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml
|
|
|
12e95e |
@@ -74,7 +74,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030440
|
|
|
12e95e |
stigid@ol8: OL08-00-030210
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030470
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030210
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030200
|
|
|
12e95e |
stigid@sle12: SLES-12-020390
|
|
|
12e95e |
stigid@sle15: SLES-15-030190
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010145
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml
|
|
|
12e95e |
index 6f7cea26e16..5dc13a0a43a 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml
|
|
|
12e95e |
@@ -70,7 +70,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030440
|
|
|
12e95e |
stigid@ol8: OL08-00-030270
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030440
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030270
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030200
|
|
|
12e95e |
stigid@sle12: SLES-12-020370
|
|
|
12e95e |
stigid@sle15: SLES-15-030220
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010142
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml
|
|
|
12e95e |
index 718dcb8a9d9..120d6fa84d3 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml
|
|
|
12e95e |
@@ -52,7 +52,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030910
|
|
|
12e95e |
stigid@ol8: OL08-00-030362
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030890
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030362
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030361
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010270
|
|
|
12e95e |
vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890
|
|
|
12e95e |
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml
|
|
|
12e95e |
index 643f075f46a..4caa7c66986 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml
|
|
|
12e95e |
@@ -49,7 +49,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030910
|
|
|
12e95e |
stigid@ol8: OL08-00-030363
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030900
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030363
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030361
|
|
|
12e95e |
vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890
|
|
|
12e95e |
|
|
|
12e95e |
{{{ complete_ocil_entry_audit_syscall(syscall="rmdir") }}}
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml
|
|
|
12e95e |
index 9cf3c4668bc..8fea9dc4582 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml
|
|
|
12e95e |
@@ -52,7 +52,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030910
|
|
|
12e95e |
stigid@ol8: OL08-00-030364
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030910
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030364
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030361
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010267
|
|
|
12e95e |
vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890
|
|
|
12e95e |
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml
|
|
|
12e95e |
index d0ebbdbd723..bee18e99b52 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml
|
|
|
12e95e |
@@ -52,7 +52,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030910
|
|
|
12e95e |
stigid@ol8: OL08-00-030365
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030920
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030365
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030361
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010268
|
|
|
12e95e |
vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890
|
|
|
12e95e |
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
|
|
|
12e95e |
index 373b12525e1..736c6643b57 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
|
|
|
12e95e |
@@ -63,7 +63,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030510
|
|
|
12e95e |
stigid@ol8: OL08-00-030470
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030500
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030470
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030420
|
|
|
12e95e |
stigid@sle12: SLES-12-020520
|
|
|
12e95e |
stigid@sle15: SLES-15-030160
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010158
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
|
|
|
12e95e |
index 2b2d82a736b..6b4176d53e3 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
|
|
|
12e95e |
@@ -66,7 +66,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030510
|
|
|
12e95e |
stigid@ol8: OL08-00-030460
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030550
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030460
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030420
|
|
|
12e95e |
stigid@sle12: SLES-12-020510
|
|
|
12e95e |
stigid@sle15: SLES-15-030320
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010157
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
|
|
|
12e95e |
index dcb3d0f0525..90d45b6787e 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
|
|
|
12e95e |
@@ -66,7 +66,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030510
|
|
|
12e95e |
stigid@ol8: OL08-00-030440
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030510
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030440
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030420
|
|
|
12e95e |
stigid@sle12: SLES-12-020490
|
|
|
12e95e |
stigid@sle15: SLES-15-030150
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010155
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml
|
|
|
12e95e |
index e68d892bb90..6df936e489c 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml
|
|
|
12e95e |
@@ -60,7 +60,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030510
|
|
|
12e95e |
stigid@ol8: OL08-00-030450
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030530
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030450
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030420
|
|
|
12e95e |
stigid@sle12: SLES-12-020540
|
|
|
12e95e |
stigid@sle15: SLES-15-030180
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010160
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
|
|
|
12e95e |
index cd6bd545e71..1b6ae818e48 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
|
|
|
12e95e |
@@ -66,7 +66,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030510
|
|
|
12e95e |
stigid@ol8: OL08-00-030430
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030520
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030430
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030420
|
|
|
12e95e |
stigid@sle12: SLES-12-020530
|
|
|
12e95e |
stigid@sle15: SLES-15-030170
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010159
|
|
|
12e95e |
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml
|
|
|
12e95e |
index 50e5b4e4f02..2f1c6d0bf22 100644
|
|
|
12e95e |
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml
|
|
|
12e95e |
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml
|
|
|
12e95e |
@@ -51,7 +51,7 @@ references:
|
|
|
12e95e |
stigid@ol7: OL07-00-030820
|
|
|
12e95e |
stigid@ol8: OL08-00-030380
|
|
|
12e95e |
stigid@rhel7: RHEL-07-030821
|
|
|
12e95e |
- stigid@rhel8: RHEL-08-030380
|
|
|
12e95e |
+ stigid@rhel8: RHEL-08-030360
|
|
|
12e95e |
stigid@sle12: SLES-12-020740
|
|
|
12e95e |
stigid@sle15: SLES-15-030530
|
|
|
12e95e |
stigid@ubuntu2004: UBTU-20-010180
|
|
|
12e95e |
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
|
|
12e95e |
index ffca983d0bd..d92bc72971c 100644
|
|
|
12e95e |
--- a/products/rhel8/profiles/stig.profile
|
|
|
12e95e |
+++ b/products/rhel8/profiles/stig.profile
|
|
|
12e95e |
@@ -560,6 +560,8 @@ selections:
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-020220
|
|
|
12e95e |
- accounts_password_pam_pwhistory_remember_system_auth
|
|
|
12e95e |
+
|
|
|
12e95e |
+ # RHEL-08-020221
|
|
|
12e95e |
- accounts_password_pam_pwhistory_remember_password_auth
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-020230
|
|
|
12e95e |
@@ -712,18 +714,11 @@ selections:
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-030200
|
|
|
12e95e |
- audit_rules_dac_modification_lremovexattr
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030210
|
|
|
12e95e |
- audit_rules_dac_modification_removexattr
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030220
|
|
|
12e95e |
- audit_rules_dac_modification_lsetxattr
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030230
|
|
|
12e95e |
- audit_rules_dac_modification_fsetxattr
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030240
|
|
|
12e95e |
- audit_rules_dac_modification_fremovexattr
|
|
|
12e95e |
+ - audit_rules_dac_modification_setxattr
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-030250
|
|
|
12e95e |
- audit_rules_privileged_commands_chage
|
|
|
12e95e |
@@ -731,8 +726,6 @@ selections:
|
|
|
12e95e |
# RHEL-08-030260
|
|
|
12e95e |
- audit_rules_execution_chcon
|
|
|
12e95e |
|
|
|
12e95e |
- # RHEL-08-030270
|
|
|
12e95e |
- - audit_rules_dac_modification_setxattr
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-030280
|
|
|
12e95e |
- audit_rules_privileged_commands_ssh_agent
|
|
|
12e95e |
@@ -787,28 +780,18 @@ selections:
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-030360
|
|
|
12e95e |
- audit_rules_kernel_module_loading_init
|
|
|
12e95e |
+ - audit_rules_kernel_module_loading_finit
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-030361
|
|
|
12e95e |
- audit_rules_file_deletion_events_rename
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030362
|
|
|
12e95e |
- audit_rules_file_deletion_events_renameat
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030363
|
|
|
12e95e |
- audit_rules_file_deletion_events_rmdir
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030364
|
|
|
12e95e |
- audit_rules_file_deletion_events_unlink
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030365
|
|
|
12e95e |
- audit_rules_file_deletion_events_unlinkat
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-030370
|
|
|
12e95e |
- audit_rules_privileged_commands_gpasswd
|
|
|
12e95e |
|
|
|
12e95e |
- # RHEL-08-030380
|
|
|
12e95e |
- - audit_rules_kernel_module_loading_finit
|
|
|
12e95e |
-
|
|
|
12e95e |
# RHEL-08-030390
|
|
|
12e95e |
- audit_rules_kernel_module_loading_delete
|
|
|
12e95e |
|
|
|
12e95e |
@@ -820,41 +803,21 @@ selections:
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-030420
|
|
|
12e95e |
- audit_rules_unsuccessful_file_modification_truncate
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030430
|
|
|
12e95e |
- audit_rules_unsuccessful_file_modification_openat
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030440
|
|
|
12e95e |
- audit_rules_unsuccessful_file_modification_open
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030450
|
|
|
12e95e |
- audit_rules_unsuccessful_file_modification_open_by_handle_at
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030460
|
|
|
12e95e |
- audit_rules_unsuccessful_file_modification_ftruncate
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030470
|
|
|
12e95e |
- audit_rules_unsuccessful_file_modification_creat
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-030480
|
|
|
12e95e |
- audit_rules_dac_modification_chown
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030490
|
|
|
12e95e |
- - audit_rules_dac_modification_chmod
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030500
|
|
|
12e95e |
- audit_rules_dac_modification_lchown
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030510
|
|
|
12e95e |
- audit_rules_dac_modification_fchownat
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030520
|
|
|
12e95e |
- audit_rules_dac_modification_fchown
|
|
|
12e95e |
|
|
|
12e95e |
- # RHEL-08-030530
|
|
|
12e95e |
+ # RHEL-08-030490
|
|
|
12e95e |
+ - audit_rules_dac_modification_chmod
|
|
|
12e95e |
- audit_rules_dac_modification_fchmodat
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030540
|
|
|
12e95e |
- audit_rules_dac_modification_fchmod
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-030550
|
|
|
12e95e |
diff --git a/products/rhel9/profiles/stig.profile b/products/rhel9/profiles/stig.profile
|
|
|
12e95e |
index eb2cac913bd..42c6d0e9aca 100644
|
|
|
12e95e |
--- a/products/rhel9/profiles/stig.profile
|
|
|
12e95e |
+++ b/products/rhel9/profiles/stig.profile
|
|
|
12e95e |
@@ -561,6 +561,8 @@ selections:
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-020220
|
|
|
12e95e |
- accounts_password_pam_pwhistory_remember_system_auth
|
|
|
12e95e |
+
|
|
|
12e95e |
+ # RHEL-08-020221
|
|
|
12e95e |
- accounts_password_pam_pwhistory_remember_password_auth
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-020230
|
|
|
12e95e |
@@ -713,18 +715,11 @@ selections:
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-030200
|
|
|
12e95e |
- audit_rules_dac_modification_lremovexattr
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030210
|
|
|
12e95e |
- audit_rules_dac_modification_removexattr
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030220
|
|
|
12e95e |
- audit_rules_dac_modification_lsetxattr
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030230
|
|
|
12e95e |
- audit_rules_dac_modification_fsetxattr
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030240
|
|
|
12e95e |
- audit_rules_dac_modification_fremovexattr
|
|
|
12e95e |
+ - audit_rules_dac_modification_setxattr
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-030250
|
|
|
12e95e |
- audit_rules_privileged_commands_chage
|
|
|
12e95e |
@@ -732,9 +727,6 @@ selections:
|
|
|
12e95e |
# RHEL-08-030260
|
|
|
12e95e |
- audit_rules_execution_chcon
|
|
|
12e95e |
|
|
|
12e95e |
- # RHEL-08-030270
|
|
|
12e95e |
- - audit_rules_dac_modification_setxattr
|
|
|
12e95e |
-
|
|
|
12e95e |
# RHEL-08-030280
|
|
|
12e95e |
- audit_rules_privileged_commands_ssh_agent
|
|
|
12e95e |
|
|
|
12e95e |
@@ -788,28 +780,18 @@ selections:
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-030360
|
|
|
12e95e |
- audit_rules_kernel_module_loading_init
|
|
|
12e95e |
+ - audit_rules_kernel_module_loading_finit
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-030361
|
|
|
12e95e |
- audit_rules_file_deletion_events_rename
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030362
|
|
|
12e95e |
- audit_rules_file_deletion_events_renameat
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030363
|
|
|
12e95e |
- audit_rules_file_deletion_events_rmdir
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030364
|
|
|
12e95e |
- audit_rules_file_deletion_events_unlink
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030365
|
|
|
12e95e |
- audit_rules_file_deletion_events_unlinkat
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-030370
|
|
|
12e95e |
- audit_rules_privileged_commands_gpasswd
|
|
|
12e95e |
|
|
|
12e95e |
- # RHEL-08-030380
|
|
|
12e95e |
- - audit_rules_kernel_module_loading_finit
|
|
|
12e95e |
-
|
|
|
12e95e |
# RHEL-08-030390
|
|
|
12e95e |
- audit_rules_kernel_module_loading_delete
|
|
|
12e95e |
|
|
|
12e95e |
@@ -821,41 +803,21 @@ selections:
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-030420
|
|
|
12e95e |
- audit_rules_unsuccessful_file_modification_truncate
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030430
|
|
|
12e95e |
- audit_rules_unsuccessful_file_modification_openat
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030440
|
|
|
12e95e |
- audit_rules_unsuccessful_file_modification_open
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030450
|
|
|
12e95e |
- audit_rules_unsuccessful_file_modification_open_by_handle_at
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030460
|
|
|
12e95e |
- audit_rules_unsuccessful_file_modification_ftruncate
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030470
|
|
|
12e95e |
- audit_rules_unsuccessful_file_modification_creat
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-030480
|
|
|
12e95e |
- audit_rules_dac_modification_chown
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030490
|
|
|
12e95e |
- - audit_rules_dac_modification_chmod
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030500
|
|
|
12e95e |
- audit_rules_dac_modification_lchown
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030510
|
|
|
12e95e |
- audit_rules_dac_modification_fchownat
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030520
|
|
|
12e95e |
- audit_rules_dac_modification_fchown
|
|
|
12e95e |
|
|
|
12e95e |
- # RHEL-08-030530
|
|
|
12e95e |
+ # RHEL-08-030490
|
|
|
12e95e |
+ - audit_rules_dac_modification_chmod
|
|
|
12e95e |
- audit_rules_dac_modification_fchmodat
|
|
|
12e95e |
-
|
|
|
12e95e |
- # RHEL-08-030540
|
|
|
12e95e |
- audit_rules_dac_modification_fchmod
|
|
|
12e95e |
|
|
|
12e95e |
# RHEL-08-030550
|