diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_seunshare.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_seunshare.rule
new file mode 100644
index 0000000000..ce7a936545
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_seunshare.rule
@@ -0,0 +1,40 @@
+documentation_complete: true
+
+prodtype: rhel7,fedora
+
+title: 'Record Any Attempts to Run seunshare'
+
+description: |-
+ At a minimum, the audit system should collect any execution attempt
+ of the <tt>seunshare</tt> command for all users and root. If the <tt>auditd</tt>
+ daemon is configured to use the <tt>augenrules</tt> program to read audit rules
+ during daemon startup (the default), add the following lines to a file with suffix
+ <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
+ <pre>-a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change</pre>
+ If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
+ utility to read audit rules during daemon startup, add the following lines to
+ <tt>/etc/audit/audit.rules</tt> file:
+ <pre>-a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change</pre>
+
+rationale: |-
+ Misuse of privileged functions, either intentionally or unintentionally by
+ authorized users, or by unauthorized external entities that have compromised system accounts,
+ is a serious and ongoing concern and can have significant adverse impacts on organizations.
+ Auditing the use of privileged functions is one way to detect such misuse and identify
+ the risk from insider and advanced persistent threast.
+ <br /><br />
+ Privileged programs are subject to escalation-of-privilege attacks,
+ which attempt to subvert their normal role of providing some necessary but
+ limited capability. As such, motivation exists to monitor these programs for
+ unusual activity.
+
+severity: medium
+
+references:
+ ospp@rhel7: FAU_GEN.1.1.c
+
+ocil: |-
+ To verify that execution of the command is being audited, run the following command:
+ <pre>$ sudo grep "path=/usr/sbin/seunshare" /etc/audit/audit.rules /etc/audit/rules.d/*</pre>
+ The output should return something similar to:
+ <pre>-a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change</pre>
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_at.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_at.rule
new file mode 100644
index 0000000000..6d1a5c909b
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_at.rule
@@ -0,0 +1,42 @@
+documentation_complete: true
+
+prodtype: rhel7,fedora
+
+title: 'Ensure auditd Collects Information on the Use of Privileged Commands - at'
+
+description: |-
+ At a minimum, the audit system should collect the execution of
+ privileged commands for all users and root. If the <tt>auditd</tt> daemon is
+ configured to use the <tt>augenrules</tt> program to read audit rules during
+ daemon startup (the default), add a line of the following form to a file with
+ suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
+ <pre>-a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged</pre>
+ If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
+ utility to read audit rules during daemon startup, add a line of the following
+ form to <tt>/etc/audit/audit.rules</tt>:
+ <pre>-a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged</pre>
+
+rationale: |-
+ Misuse of privileged functions, either intentionally or unintentionally by
+ authorized users, or by unauthorized external entities that have compromised system accounts,
+ is a serious and ongoing concern and can have significant adverse impacts on organizations.
+ Auditing the use of privileged functions is one way to detect such misuse and identify
+ the risk from insider and advanced persistent threast.
+ <br /><br />
+ Privileged programs are subject to escalation-of-privilege attacks,
+ which attempt to subvert their normal role of providing some necessary but
+ limited capability. As such, motivation exists to monitor these programs for
+ unusual activity.
+
+severity: medium
+
+references:
+ ospp@rhel7: FAU_GEN.1.1.c
+
+ocil_clause: 'it is not the case'
+
+ocil: |-
+ To verify that auditing of privileged command use is configured, run the
+ following command:
+ <pre>$ sudo grep '\bat\b' /etc/audit/audit.rules /etc/audit/rules.d/*</pre>
+ It should return a relevant line in the audit rules.
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount.rule
new file mode 100644
index 0000000000..8eb3f39f01
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount.rule
@@ -0,0 +1,42 @@
+documentation_complete: true
+
+prodtype: rhel7,fedora
+
+title: 'Ensure auditd Collects Information on the Use of Privileged Commands - mount'
+
+description: |-
+ At a minimum, the audit system should collect the execution of
+ privileged commands for all users and root. If the <tt>auditd</tt> daemon is
+ configured to use the <tt>augenrules</tt> program to read audit rules during
+ daemon startup (the default), add a line of the following form to a file with
+ suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
+ <pre>-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged</pre>
+ If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
+ utility to read audit rules during daemon startup, add a line of the following
+ form to <tt>/etc/audit/audit.rules</tt>:
+ <pre>-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged</pre>
+
+rationale: |-
+ Misuse of privileged functions, either intentionally or unintentionally by
+ authorized users, or by unauthorized external entities that have compromised system accounts,
+ is a serious and ongoing concern and can have significant adverse impacts on organizations.
+ Auditing the use of privileged functions is one way to detect such misuse and identify
+ the risk from insider and advanced persistent threast.
+ <br /><br />
+ Privileged programs are subject to escalation-of-privilege attacks,
+ which attempt to subvert their normal role of providing some necessary but
+ limited capability. As such, motivation exists to monitor these programs for
+ unusual activity.
+
+severity: medium
+
+references:
+ ospp@rhel7: FAU_GEN.1.1.c
+
+ocil_clause: 'it is not the case'
+
+ocil: |-
+ To verify that auditing of privileged command use is configured, run the
+ following command:
+ <pre>$ sudo grep mount /etc/audit/audit.rules /etc/audit/rules.d/*</pre>
+ It should return a relevant line in the audit rules.
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgidmap.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgidmap.rule
new file mode 100644
index 0000000000..bd8dbcf1bd
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgidmap.rule
@@ -0,0 +1,42 @@
+documentation_complete: true
+
+prodtype: rhel7,fedora
+
+title: 'Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap'
+
+description: |-
+ At a minimum, the audit system should collect the execution of
+ privileged commands for all users and root. If the <tt>auditd</tt> daemon is
+ configured to use the <tt>augenrules</tt> program to read audit rules during
+ daemon startup (the default), add a line of the following form to a file with
+ suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
+ <pre>-a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged</pre>
+ If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
+ utility to read audit rules during daemon startup, add a line of the following
+ form to <tt>/etc/audit/audit.rules</tt>:
+ <pre>-a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged</pre>
+
+rationale: |-
+ Misuse of privileged functions, either intentionally or unintentionally by
+ authorized users, or by unauthorized external entities that have compromised system accounts,
+ is a serious and ongoing concern and can have significant adverse impacts on organizations.
+ Auditing the use of privileged functions is one way to detect such misuse and identify
+ the risk from insider and advanced persistent threast.
+ <br /><br />
+ Privileged programs are subject to escalation-of-privilege attacks,
+ which attempt to subvert their normal role of providing some necessary but
+ limited capability. As such, motivation exists to monitor these programs for
+ unusual activity.
+
+severity: medium
+
+references:
+ ospp@rhel7: FAU_GEN.1.1.c
+
+ocil_clause: 'it is not the case'
+
+ocil: |-
+ To verify that auditing of privileged command use is configured, run the
+ following command:
+ <pre>$ sudo grep newgidmap /etc/audit/audit.rules /etc/audit/rules.d/*</pre>
+ It should return a relevant line in the audit rules.
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newuidmap.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newuidmap.rule
new file mode 100644
index 0000000000..199dc381a1
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newuidmap.rule
@@ -0,0 +1,42 @@
+documentation_complete: true
+
+prodtype: rhel7,fedora
+
+title: 'Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap'
+
+description: |-
+ At a minimum, the audit system should collect the execution of
+ privileged commands for all users and root. If the <tt>auditd</tt> daemon is
+ configured to use the <tt>augenrules</tt> program to read audit rules during
+ daemon startup (the default), add a line of the following form to a file with
+ suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
+ <pre>-a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged</pre>
+ If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
+ utility to read audit rules during daemon startup, add a line of the following
+ form to <tt>/etc/audit/audit.rules</tt>:
+ <pre>-a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged</pre>
+
+rationale: |-
+ Misuse of privileged functions, either intentionally or unintentionally by
+ authorized users, or by unauthorized external entities that have compromised system accounts,
+ is a serious and ongoing concern and can have significant adverse impacts on organizations.
+ Auditing the use of privileged functions is one way to detect such misuse and identify
+ the risk from insider and advanced persistent threast.
+ <br /><br />
+ Privileged programs are subject to escalation-of-privilege attacks,
+ which attempt to subvert their normal role of providing some necessary but
+ limited capability. As such, motivation exists to monitor these programs for
+ unusual activity.
+
+severity: medium
+
+references:
+ ospp@rhel7: FAU_GEN.1.1.c
+
+ocil_clause: 'it is not the case'
+
+ocil: |-
+ To verify that auditing of privileged command use is configured, run the
+ following command:
+ <pre>$ sudo grep newuidmap /etc/audit/audit.rules /etc/audit/rules.d/*</pre>
+ It should return a relevant line in the audit rules.
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_usernetctl.rule b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_usernetctl.rule
new file mode 100644
index 0000000000..c574f82d25
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_usernetctl.rule
@@ -0,0 +1,42 @@
+documentation_complete: true
+
+prodtype: rhel7,fedora
+
+title: 'Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl'
+
+description: |-
+ At a minimum, the audit system should collect the execution of
+ privileged commands for all users and root. If the <tt>auditd</tt> daemon is
+ configured to use the <tt>augenrules</tt> program to read audit rules during
+ daemon startup (the default), add a line of the following form to a file with
+ suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
+ <pre>-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged</pre>
+ If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
+ utility to read audit rules during daemon startup, add a line of the following
+ form to <tt>/etc/audit/audit.rules</tt>:
+ <pre>-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged</pre>
+
+rationale: |-
+ Misuse of privileged functions, either intentionally or unintentionally by
+ authorized users, or by unauthorized external entities that have compromised system accounts,
+ is a serious and ongoing concern and can have significant adverse impacts on organizations.
+ Auditing the use of privileged functions is one way to detect such misuse and identify
+ the risk from insider and advanced persistent threast.
+ <br /><br />
+ Privileged programs are subject to escalation-of-privilege attacks,
+ which attempt to subvert their normal role of providing some necessary but
+ limited capability. As such, motivation exists to monitor these programs for
+ unusual activity.
+
+severity: medium
+
+references:
+ ospp@rhel7: FAU_GEN.1.1.c
+
+ocil_clause: 'it is not the case'
+
+ocil: |-
+ To verify that auditing of privileged command use is configured, run the
+ following command:
+ <pre>$ sudo grep usernetctl /etc/audit/audit.rules /etc/audit/rules.d/*</pre>
+ It should return a relevant line in the audit rules.
diff --git a/rhel7/profiles/ospp42-draft.profile b/rhel7/profiles/ospp42-draft.profile
index 9802576814..270a94f85f 100644
--- a/rhel7/profiles/ospp42-draft.profile
+++ b/rhel7/profiles/ospp42-draft.profile
@@ -121,6 +121,7 @@ selections:
- audit_rules_execution_restorecon
- audit_rules_execution_semanage
- audit_rules_execution_setsebool
+ - audit_rules_execution_seunshare
- audit_rules_mac_modification
- audit_rules_dac_modification_chown
- audit_rules_unsuccessful_file_modification_chown
@@ -130,15 +131,20 @@ selections:
- audit_rules_unsuccessful_file_modification_fchown
- audit_rules_dac_modification_lchown
- audit_rules_unsuccessful_file_modification_lchown
+ - audit_rules_privileged_commands_at
+ - audit_rules_privileged_commands_mount
- audit_rules_privileged_commands_passwd
- audit_rules_privileged_commands_unix_chkpwd
- audit_rules_privileged_commands_userhelper
+ - audit_rules_privileged_commands_usernetctl
- audit_rules_privileged_commands_chage
- audit_rules_privileged_commands_chsh
- audit_rules_privileged_commands_pt_chown
- audit_rules_sysadmin_actions
- audit_rules_privileged_commands_gpasswd
+ - audit_rules_privileged_commands_newgidmap
- audit_rules_privileged_commands_newgrp
+ - audit_rules_privileged_commands_newuidmap
- audit_rules_usergroup_modification_group
- audit_rules_usergroup_modification_gshadow
- audit_rules_usergroup_modification_opasswd
diff --git a/shared/bash_remediation_functions/perform_audit_rules_privileged_commands_remediation.sh b/shared/bash_remediation_functions/perform_audit_rules_privileged_commands_remediation.sh
index 73a08dd98a..3fd55c84d4 100644
--- a/shared/bash_remediation_functions/perform_audit_rules_privileged_commands_remediation.sh
+++ b/shared/bash_remediation_functions/perform_audit_rules_privileged_commands_remediation.sh
@@ -79,7 +79,7 @@ do
local count_of_inspected_files=0
# Define expected rule form for this binary
- expected_rule="-a always,exit -F path=${sbinary} -F perm=x -F auid>=${min_auid} -F auid!=4294967295 -k privileged"
+ expected_rule="-a always,exit -F path=${sbinary} -F perm=x -F auid>=${min_auid} -F auid!=unset -k privileged"
# If list of audit rules files to be inspected is empty, just add new rule and move on to next binary
if [[ ${#files_to_inspect[@]} -eq 0 ]]; then
@@ -100,9 +100,9 @@ do
# * existing rule contains all arguments from expected rule form (though can contain
# them in arbitrary order)
- base_search=$(sed -e '/-a always,exit/!d' -e '/-F path='"${sbinary_esc}"'/!d' \
- -e '/-F path=[^[:space:]]\+/!d' -e '/-F perm=.*/!d' \
- -e '/-F auid>='"${min_auid}"'/!d' -e '/-F auid!=4294967295/!d' \
+ base_search=$(sed -e '/-a always,exit/!d' -e '/-F path='"${sbinary_esc}"'/!d' \
+ -e '/-F path=[^[:space:]]\+/!d' -e '/-F perm=.*/!d' \
+ -e '/-F auid>='"${min_auid}"'/!d' -e '/-F auid!=\(?:4294967295\|unset\)/!d' \
-e '/-k privileged/!d' "$afile")
# Increase the count of inspected files for this sbinary
diff --git a/shared/templates/csv/audit_rules_execution.csv b/shared/templates/csv/audit_rules_execution.csv
index 8a78a4323c..45aa7493f3 100644
--- a/shared/templates/csv/audit_rules_execution.csv
+++ b/shared/templates/csv/audit_rules_execution.csv
@@ -3,3 +3,4 @@
/usr/sbin/semanage
/usr/sbin/setfiles
/usr/sbin/setsebool
+/usr/sbin/seunshare
diff --git a/shared/templates/csv/audit_rules_privileged_commands.csv b/shared/templates/csv/audit_rules_privileged_commands.csv
index 2d45332344..7fa26ffe2d 100644
--- a/shared/templates/csv/audit_rules_privileged_commands.csv
+++ b/shared/templates/csv/audit_rules_privileged_commands.csv
@@ -1,8 +1,12 @@
+/usr/bin/at
/usr/bin/chage
/usr/bin/chsh
/usr/bin/crontab
/usr/bin/gpasswd
+/usr/bin/mount
+/usr/bin/newgidmap
/usr/bin/newgrp
+/usr/bin/newuidmap
/usr/sbin/pam_timestamp_check
/usr/bin/passwd
/usr/sbin/postdrop
@@ -15,3 +19,4 @@
/usr/bin/umount
/usr/sbin/unix_chkpwd
/usr/sbin/userhelper
+/usr/sbin/usernetctl
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/generate_privileged_commands_rule.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/generate_privileged_commands_rule.sh
new file mode 100755
index 0000000000..9dc0cd1ce2
--- /dev/null
+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/generate_privileged_commands_rule.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+AUID=$1
+KEY=$2
+RULEPATH=$3
+for file in $(find / -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null); do
+ echo "-a always,exit -F path=$file -F perm=x -F auid>=$AUID -F auid!=unset -k $KEY" >> $RULEPATH
+done
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_audit.rules b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_audit.rules
deleted file mode 100644
index 703bbafe10..0000000000
--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_audit.rules
+++ /dev/null
@@ -1,37 +0,0 @@
--a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/at -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/wall -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/write -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/ksu -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/locate -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/pkexec -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/libexec/polkit-1/polkit-agent-helper-1 -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/libexec/pt_chown -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/libexec/utempter/utempter -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/sbin/netreport -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/sbin/pam_timestamp_check -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/lib64/dbus-1/dbus-daemon-launch-helper -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/bin/mount -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/bin/su -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/bin/umount -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/bin/cgclassify -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/bin/cgexec -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
--a always,exit -F path=/bin/ping6 -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_auditctl_rules_configured.pass.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_auditctl_rules_configured.pass.sh
index 60b9eb0c45..a8a25ebdb3 100644
--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_auditctl_rules_configured.pass.sh
+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_auditctl_rules_configured.pass.sh
@@ -2,7 +2,6 @@
# profiles = xccdf_org.ssgproject.content_profile_pci-dss
# remediation = bash
-cp rhel6_audit.rules /etc/audit/rules.d/privileged.rules
-cp rhel6_audit.rules /etc/audit/audit.rules
+./generate_privileged_commands_rule.sh 500 privileged /etc/audit/audit.rules
# This is a trick to fail setup of this test in rhel7 systems
ls /etc/sysconfig/auditd
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_augenrules_rules_configured.pass.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_augenrules_rules_configured.pass.sh
index 1b628be506..5594d7566a 100644
--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_augenrules_rules_configured.pass.sh
+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel6_augenrules_rules_configured.pass.sh
@@ -2,6 +2,5 @@
# profiles = xccdf_org.ssgproject.content_profile_pci-dss
# remediation = bash
-cp rhel6_audit.rules /etc/audit/rules.d/privileged.rules
-cp rhel6_audit.rules /etc/audit/audit.rules
+./generate_privileged_commands_rule.sh 500 privileged /etc/audit/rules.d/privileged.rules
sed -i "s/USE_AUGENRULES=.*/USE_AUGENRULES=\"yes\"/" /etc/sysconfig/auditd
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_auditctl_rules_configured.pass.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_auditctl_rules_configured.pass.sh
index ee95d13d5d..3f891eed60 100644
--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_auditctl_rules_configured.pass.sh
+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_auditctl_rules_configured.pass.sh
@@ -2,6 +2,5 @@
# profiles = xccdf_org.ssgproject.content_profile_pci-dss
# remediation = bash
-cp rhel7_privileged.rules /etc/audit/rules.d/privileged.rules
-cp rhel7_privileged.rules /etc/audit/audit.rules
+./generate_privileged_commands_rule.sh 1000 privileged /etc/audit/audit.rules
sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_augenrules_rules_configured.pass.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_augenrules_rules_configured.pass.sh
index 77f9549418..74583bf989 100644
--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_augenrules_rules_configured.pass.sh
+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_augenrules_rules_configured.pass.sh
@@ -2,7 +2,6 @@
# profiles = xccdf_org.ssgproject.content_profile_pci-dss
# remediation = bash
-cp rhel7_privileged.rules /etc/audit/rules.d/privileged.rules
-cp rhel7_privileged.rules /etc/audit/audit.rules
+./generate_privileged_commands_rule.sh 1000 privileged /etc/audit/rules.d/privileged.rules
# This is a trick to fail setup of this test in rhel6 systems
ls /usr/lib/systemd/system/auditd.service
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_own_key.rules b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_own_key.rules
deleted file mode 100644
index 4df6d4ec8b..0000000000
--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_own_key.rules
+++ /dev/null
@@ -1,30 +0,0 @@
--a always,exit -F path=/usr/bin/wall -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/bin/write -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/bin/pkexec -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/bin/locate -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/sbin/netreport -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/lib/polkit-1/polkit-agent-helper-1 -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/libexec/utempter/utempter -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/libexec/dbus-1/dbus-daemon-launch-helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
--a always,exit -F path=/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache -F perm=x -F auid>=1000 -F auid!=4294967295 -k own_key
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_privileged.rules b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_privileged.rules
deleted file mode 100644
index 4eb644acbc..0000000000
--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_privileged.rules
+++ /dev/null
@@ -1,30 +0,0 @@
--a always,exit -F path=/usr/bin/wall -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/write -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/pkexec -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/bin/locate -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/sbin/netreport -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/lib/polkit-1/polkit-agent-helper-1 -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/libexec/utempter/utempter -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/libexec/dbus-1/dbus-daemon-launch-helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
--a always,exit -F path=/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
diff --git a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_rules_with_own_key.pass.sh b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_rules_with_own_key.pass.sh
index ac5ef2ddd9..35a5fde2c6 100644
--- a/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_rules_with_own_key.pass.sh
+++ b/tests/data/group_system/group_auditing/group_auditd_configure_rules/group_audit_privileged_commands/rule_audit_rules_privileged_commands/rhel7_rules_with_own_key.pass.sh
@@ -2,7 +2,6 @@
# profiles = xccdf_org.ssgproject.content_profile_pci-dss
# remediation = bash
-cp rhel7_own_key.rules /etc/audit/rules.d/privileged.rules
-cp rhel7_own_key.rules /etc/audit/audit.rules
+./generate_privileged_commands_rule.sh 1000 own_key /etc/audit/rules.d/privileged.rules
# This is a trick to fail setup of this test in rhel6 systems
ls /usr/lib/systemd/system/auditd.service