Skip to content

[Ubuntu 24.04] Add stigid@ubuntu2404 references: Auditing Rules #14482

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
hdean3 wants to merge 1 commit into from
Closed

[Ubuntu 24.04] Add stigid@ubuntu2404 references: Auditing Rules #14482

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions ...ting/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_chmod/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@ references:
stigid@ol8: OL08-00-030490
stigid@sle12: SLES-12-020460
stigid@sle15: SLES-15-030290
stigid@ubuntu2404: UBTU-24-900150

ocil_clause: 'the system is not configured to audit permission changes'

Expand Down
1 change: 1 addition & 0 deletions ...ting/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_chown/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@ references:
stigid@ol8: OL08-00-030480
stigid@sle12: SLES-12-020420
stigid@sle15: SLES-15-030250
stigid@ubuntu2404: UBTU-24-900140

{{{ complete_ocil_entry_audit_syscall(syscall="chown") }}}

Expand Down
1 change: 1 addition & 0 deletions ...ing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@ references:
stigid@ol8: OL08-00-030490
stigid@sle12: SLES-12-020460
stigid@sle15: SLES-15-030290
stigid@ubuntu2404: UBTU-24-900150

{{{ complete_ocil_entry_audit_syscall(syscall="fchmod") }}}

Expand Down
1 change: 1 addition & 0 deletions ...g/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,7 @@ references:
stigid@ol8: OL08-00-030490
stigid@sle12: SLES-12-020460
stigid@sle15: SLES-15-030290
stigid@ubuntu2404: UBTU-24-900150

{{{ complete_ocil_entry_audit_syscall(syscall="fchmodat") }}}

Expand Down
1 change: 1 addition & 0 deletions ...ing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@ references:
stigid@ol8: OL08-00-030480
stigid@sle12: SLES-12-020420
stigid@sle15: SLES-15-030250
stigid@ubuntu2404: UBTU-24-900140

{{{ complete_ocil_entry_audit_syscall(syscall="fchown") }}}

Expand Down
1 change: 1 addition & 0 deletions ...g/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,7 @@ references:
stigid@ol8: OL08-00-030480
stigid@sle12: SLES-12-020420
stigid@sle15: SLES-15-030250
stigid@ubuntu2404: UBTU-24-900140

{{{ complete_ocil_entry_audit_syscall(syscall="fchownat") }}}

Expand Down
1 change: 1 addition & 0 deletions ...ditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,7 @@ references:
stigid@ol8: OL08-00-030200
stigid@sle12: SLES-12-020370
stigid@sle15: SLES-15-030190
stigid@ubuntu2404: UBTU-24-900130

{{{ complete_ocil_entry_audit_syscall(syscall="fremovexattr") }}}

Expand Down
1 change: 1 addition & 0 deletions .../auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,7 @@ references:
stigid@ol8: OL08-00-030200
stigid@sle12: SLES-12-020370
stigid@sle15: SLES-15-030190
stigid@ubuntu2404: UBTU-24-900130

{{{ complete_ocil_entry_audit_syscall(syscall="fsetxattr") }}}

Expand Down
1 change: 1 addition & 0 deletions ...ing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ references:
stigid@ol8: OL08-00-030480
stigid@sle12: SLES-12-020420
stigid@sle15: SLES-15-030250
stigid@ubuntu2404: UBTU-24-900140

{{{ complete_ocil_entry_audit_syscall(syscall="lchown") }}}

Expand Down
1 change: 1 addition & 0 deletions ...ditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lremovexattr/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,7 @@ references:
stigid@ol8: OL08-00-030200
stigid@sle12: SLES-12-020370
stigid@sle15: SLES-15-030190
stigid@ubuntu2404: UBTU-24-900130

{{{ complete_ocil_entry_audit_syscall(syscall="lremovexattr") }}}

Expand Down
1 change: 1 addition & 0 deletions .../auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,7 @@ references:
stigid@ol8: OL08-00-030200
stigid@sle12: SLES-12-020370
stigid@sle15: SLES-15-030190
stigid@ubuntu2404: UBTU-24-900130

{{{ complete_ocil_entry_audit_syscall(syscall="lsetxattr") }}}

Expand Down
1 change: 1 addition & 0 deletions ...uditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,7 @@ references:
stigid@ol8: OL08-00-030200
stigid@sle12: SLES-12-020370
stigid@sle15: SLES-15-030190
stigid@ubuntu2404: UBTU-24-900130

{{{ complete_ocil_entry_audit_syscall(syscall="removexattr") }}}

Expand Down
1 change: 1 addition & 0 deletions ...g/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,7 @@ references:
stigid@ol8: OL08-00-030200
stigid@sle12: SLES-12-020370
stigid@sle15: SLES-15-030190
stigid@ubuntu2404: UBTU-24-900130

{{{ complete_ocil_entry_audit_syscall(syscall="setxattr") }}}

Expand Down
1 change: 1 addition & 0 deletions .../auditd_configure_rules/audit_execution_acl_commands/audit_rules_execution_chacl/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ references:
stigid@ol8: OL08-00-030570
stigid@sle12: SLES-12-020620
stigid@sle15: SLES-15-030440
stigid@ubuntu2404: UBTU-24-900240

{{{ ocil_fix_srg_privileged_command("chacl", "/usr/bin/", "perm_mod") }}}

Expand Down
1 change: 1 addition & 0 deletions ...uditd_configure_rules/audit_execution_acl_commands/audit_rules_execution_setfacl/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ references:
stigid@ol8: OL08-00-030330
stigid@sle12: SLES-12-020610
stigid@sle15: SLES-15-030430
stigid@ubuntu2404: UBTU-24-900230

{{{ ocil_fix_srg_privileged_command("setfacl", "/usr/bin/", "perm_mod") }}}

Expand Down
1 change: 1 addition & 0 deletions ...itd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_chcon/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@ references:
stigid@ol8: OL08-00-030260
stigid@sle12: SLES-12-020630
stigid@sle15: SLES-15-030450
stigid@ubuntu2404: UBTU-24-900210

{{{ ocil_fix_srg_privileged_command("chcon", "/usr/bin/", "perm_mod") }}}

Expand Down
1 change: 1 addition & 0 deletions ...nfigure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rename/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,7 @@ references:
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-OS-000467-GPOS-00211,SRG-OS-000468-GPOS-00212,SRG-APP-000495-CTR-001235,SRG-APP-000499-CTR-001255,SRG-APP-000501-CTR-001265,SRG-APP-000502-CTR-001270
stigid@ol7: OL07-00-030910
stigid@ol8: OL08-00-030361
stigid@ubuntu2404: UBTU-24-900540

{{{ complete_ocil_entry_audit_syscall(syscall="rename") }}}

Expand Down
1 change: 1 addition & 0 deletions ...igure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ references:
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-OS-000467-GPOS-00211,SRG-OS-000468-GPOS-00212,SRG-APP-000495-CTR-001235,SRG-APP-000499-CTR-001255,SRG-APP-000501-CTR-001265,SRG-APP-000502-CTR-001270
stigid@ol7: OL07-00-030910
stigid@ol8: OL08-00-030361
stigid@ubuntu2404: UBTU-24-900540

{{{ complete_ocil_entry_audit_syscall(syscall="renameat") }}}

Expand Down
1 change: 1 addition & 0 deletions ...onfigure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ references:
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-OS-000467-GPOS-00211,SRG-OS-000468-GPOS-00212,SRG-APP-000495-CTR-001235,SRG-APP-000499-CTR-001255,SRG-APP-000501-CTR-001265,SRG-APP-000502-CTR-001270
stigid@ol7: OL07-00-030910
stigid@ol8: OL08-00-030361
stigid@ubuntu2404: UBTU-24-900540

{{{ complete_ocil_entry_audit_syscall(syscall="rmdir") }}}

Expand Down
1 change: 1 addition & 0 deletions ...nfigure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,7 @@ references:
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-OS-000467-GPOS-00211,SRG-OS-000468-GPOS-00212,SRG-APP-000495-CTR-001235,SRG-APP-000499-CTR-001255,SRG-APP-000501-CTR-001265,SRG-APP-000502-CTR-001270
stigid@ol7: OL07-00-030910
stigid@ol8: OL08-00-030361
stigid@ubuntu2404: UBTU-24-900540

{{{ complete_ocil_entry_audit_syscall(syscall="unlink") }}}

Expand Down
1 change: 1 addition & 0 deletions ...igure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ references:
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-OS-000467-GPOS-00211,SRG-OS-000468-GPOS-00212,SRG-APP-000495-CTR-001235,SRG-APP-000499-CTR-001255,SRG-APP-000501-CTR-001265,SRG-APP-000502-CTR-001270
stigid@ol7: OL07-00-030910
stigid@ol8: OL08-00-030361
stigid@ubuntu2404: UBTU-24-900540

{{{ complete_ocil_entry_audit_syscall(syscall="unlinkat") }}}

Expand Down
1 change: 1 addition & 0 deletions ...e_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@ references:
stigid@ol8: OL08-00-030420
stigid@sle12: SLES-12-020490
stigid@sle15: SLES-15-030150
stigid@ubuntu2404: UBTU-24-900160

ocil: |-
{{{ ocil_audit_rules_unsuccessful_file_modification("creat", "access") | indent(4) }}}
Expand Down
1 change: 1 addition & 0 deletions ...les/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@ references:
stigid@ol8: OL08-00-030420
stigid@sle12: SLES-12-020490
stigid@sle15: SLES-15-030150
stigid@ubuntu2404: UBTU-24-900160

ocil: |-
{{{ ocil_audit_rules_unsuccessful_file_modification("ftruncate", "access") | indent(4) }}}
Expand Down
1 change: 1 addition & 0 deletions ...re_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ references:
stigid@ol8: OL08-00-030420
stigid@sle12: SLES-12-020490
stigid@sle15: SLES-15-030150
stigid@ubuntu2404: UBTU-24-900160

ocil: |-
{{{ ocil_audit_rules_unsuccessful_file_modification("open", "access") | indent(4) }}}
Expand Down
1 change: 1 addition & 0 deletions ...t_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@ references:
stigid@ol8: OL08-00-030420
stigid@sle12: SLES-12-020490
stigid@sle15: SLES-15-030150
stigid@ubuntu2404: UBTU-24-900160

ocil: |-
{{{ ocil_audit_rules_unsuccessful_file_modification("open_by_handle_at", "access") | indent(4) }}}
Expand Down
1 change: 1 addition & 0 deletions ..._rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@ references:
stigid@ol8: OL08-00-030420
stigid@sle12: SLES-12-020490
stigid@sle15: SLES-15-030150
stigid@ubuntu2404: UBTU-24-900160

ocil: |-
{{{ ocil_audit_rules_unsuccessful_file_modification("openat", "access") | indent(4) }}}
Expand Down
1 change: 1 addition & 0 deletions ...ules/audit_file_modification/audit_rules_unsuccessful_file_modification_truncate/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,7 @@ references:
stigid@ol8: OL08-00-030420
stigid@sle12: SLES-12-020490
stigid@sle15: SLES-15-030150
stigid@ubuntu2404: UBTU-24-900160

ocil: |-
{{{ ocil_audit_rules_unsuccessful_file_modification("truncate", "access") | indent(4) }}}
Expand Down
1 change: 1 addition & 0 deletions ...igure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ references:
stigid@ol8: OL08-00-030390
stigid@sle12: SLES-12-020730
stigid@sle15: SLES-15-030520
stigid@ubuntu2404: UBTU-24-900350

{{{ complete_ocil_entry_audit_syscall(syscall="delete_module") }}}

Expand Down
1 change: 1 addition & 0 deletions ...figure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ references:
stigid@ol8: OL08-00-030360
stigid@sle12: SLES-12-020740
stigid@sle15: SLES-15-030530
stigid@ubuntu2404: UBTU-24-900340

{{{ complete_ocil_entry_audit_syscall(syscall="finit_module") }}}

Expand Down
1 change: 1 addition & 0 deletions ...nfigure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ references:
stigid@ol8: OL08-00-030360
stigid@sle12: SLES-12-020740
stigid@sle15: SLES-15-030530
stigid@ubuntu2404: UBTU-24-900340

{{{ complete_ocil_entry_audit_syscall(syscall="init_module") }}}

Expand Down
1 change: 1 addition & 0 deletions ...iting/auditd_configure_rules/audit_login_events/audit_rules_login_events_faillog/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ references:
nist@sle12: AU-3,AU-12(a),AU-12(c),MA-4(1)(a)
srg: SRG-OS-000037-GPOS-00015
stigid@sle12: SLES-12-020760
stigid@ubuntu2404: UBTU-24-900250

ocil_clause: 'there is no output'

Expand Down
1 change: 1 addition & 0 deletions ...iting/auditd_configure_rules/audit_login_events/audit_rules_login_events_lastlog/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ references:
stigid@ol8: OL08-00-030600
stigid@sle12: SLES-12-020660
stigid@sle15: SLES-15-030480
stigid@ubuntu2404: UBTU-24-900260

ocil_clause: 'the command does not return a line, or the line is commented out'

Expand Down
1 change: 1 addition & 0 deletions ..._rules/audit_privileged_commands/audit_rules_privileged_commands_apparmor_parser/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ severity: medium

references:
srg: SRG-OS-000064-GPOS-00033
stigid@ubuntu2404: UBTU-24-900220

ocil: |-
To verify that execution of the command is being audited, run the following command:
Expand Down
1 change: 1 addition & 0 deletions ..._configure_rules/audit_privileged_commands/audit_rules_privileged_commands_chage/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@ references:
stigid@ol8: OL08-00-030250
stigid@sle12: SLES-12-020690
stigid@sle15: SLES-15-030120
stigid@ubuntu2404: UBTU-24-900300

{{{ ocil_fix_srg_privileged_command("chage") }}}

Expand Down
1 change: 1 addition & 0 deletions ...d_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_chfn/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ references:
nist: AU-3,AU-12(a),AU-12(c),MA-4(1)(a)
stigid@sle12: SLES-12-020280
stigid@sle15: SLES-15-030340
stigid@ubuntu2404: UBTU-24-900080

ocil_clause: '{{{ ocil_clause_audit() }}}'

Expand Down
1 change: 1 addition & 0 deletions ...d_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_chsh/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@ references:
stigid@ol8: OL08-00-030410
stigid@sle12: SLES-12-020580
stigid@sle15: SLES-15-030100
stigid@ubuntu2404: UBTU-24-900190

{{{ ocil_fix_srg_privileged_command("chsh") }}}

Expand Down
1 change: 1 addition & 0 deletions ...onfigure_rules/audit_privileged_commands/audit_rules_privileged_commands_crontab/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ references:
stigid@ol8: OL08-00-030400
stigid@sle12: SLES-12-020710
stigid@sle15: SLES-15-030130
stigid@ubuntu2404: UBTU-24-900320

{{{ ocil_fix_srg_privileged_command("crontab") }}}

Expand Down
1 change: 1 addition & 0 deletions ..._configure_rules/audit_privileged_commands/audit_rules_privileged_commands_fdisk/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ severity: medium

references:
srg: SRG-OS-000477-GPOS-00222
stigid@ubuntu2404: UBTU-24-900750

ocil_clause: '{{{ ocil_clause_audit() }}}'

Expand Down
1 change: 1 addition & 0 deletions ...onfigure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@ references:
stigid@ol8: OL08-00-030370
stigid@sle12: SLES-12-020560
stigid@sle15: SLES-15-030080
stigid@ubuntu2404: UBTU-24-900290

{{{ ocil_fix_srg_privileged_command("gpasswd") }}}

Expand Down
1 change: 1 addition & 0 deletions ...d_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_kmod/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ references:
stigid@ol8: OL08-00-030580
stigid@sle12: SLES-12-020360
stigid@sle15: SLES-15-030410
stigid@ubuntu2404: UBTU-24-900740

{{{ ocil_fix_srg_privileged_command("kmod") }}}

Expand Down
1 change: 1 addition & 0 deletions ...nfigure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ references:
nist: AU-12(a),AU-12.1(ii),AU-3,AU-3.1,AU-12(c),AU-12.1(iv),MA-4(1)(a)
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215
stigid@sle15: SLES-15-030400
stigid@ubuntu2404: UBTU-24-900730

ocil_clause: '{{{ ocil_clause_audit() }}}'

Expand Down
1 change: 1 addition & 0 deletions ..._configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ references:
stigid@ol7: OL07-00-030740
stigid@ol8: OL08-00-030300
stigid@sle12: SLES-12-020290
stigid@ubuntu2404: UBTU-24-900090

{{{ ocil_fix_srg_privileged_command("mount") }}}

Expand Down
1 change: 1 addition & 0 deletions ...configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgrp/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@ references:
stigid@ol8: OL08-00-030350
stigid@sle12: SLES-12-020570
stigid@sle15: SLES-15-030090
stigid@ubuntu2404: UBTU-24-900200

{{{ ocil_fix_srg_privileged_command("newgrp") }}}

Expand Down
1 change: 1 addition & 0 deletions ...es/audit_privileged_commands/audit_rules_privileged_commands_pam_timestamp_check/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@ references:
stigid@ol8: OL08-00-030340
stigid@sle12: SLES-12-020720
stigid@sle15: SLES-15-030510
stigid@ubuntu2404: UBTU-24-900330

{{% if product not in ["sle12", "sle15", "slmicro5", "slmicro6"] %}}
{{{ ocil_fix_srg_privileged_command("pam_timestamp_check", "/usr/sbin/") }}}
Expand Down
1 change: 1 addition & 0 deletions ...configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@ references:
stigid@ol8: OL08-00-030290
stigid@sle12: SLES-12-020550
stigid@sle15: SLES-15-030070
stigid@ubuntu2404: UBTU-24-900270

{{{ ocil_fix_srg_privileged_command("passwd") }}}

Expand Down
1 change: 1 addition & 0 deletions ...figure_rules/audit_privileged_commands/audit_rules_privileged_commands_ssh_agent/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ references:
stigid@ol8: OL08-00-030280
stigid@sle12: SLES-12-020310
stigid@sle15: SLES-15-030370
stigid@ubuntu2404: UBTU-24-900110

{{{ ocil_fix_srg_privileged_command("ssh-agent") }}}

Expand Down
1 change: 1 addition & 0 deletions ...gure_rules/audit_privileged_commands/audit_rules_privileged_commands_ssh_keysign/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,7 @@ references:
stigid@ol8: OL08-00-030320
stigid@sle12: SLES-12-020320
stigid@sle15: SLES-15-030060
stigid@ubuntu2404: UBTU-24-900120

{{{ ocil_fix_srg_privileged_command("ssh-keysign", ssh_keysign_path) }}}

Expand Down
1 change: 1 addition & 0 deletions ...itd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_su/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ references:
stigid@ol8: OL08-00-030190
stigid@sle12: SLES-12-020250
stigid@sle15: SLES-15-030550
stigid@ubuntu2404: UBTU-24-900070

{{{ ocil_fix_srg_privileged_command("su") }}}

Expand Down
1 change: 1 addition & 0 deletions ...d_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudo/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ references:
stigid@ol8: OL08-00-030550
stigid@sle12: SLES-12-020260
stigid@sle15: SLES-15-030560
stigid@ubuntu2404: UBTU-24-900170

{{{ ocil_fix_srg_privileged_command("sudo") }}}
template:
Expand Down
1 change: 1 addition & 0 deletions ...nfigure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudoedit/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ references:
nist@sle15: AU-3,AU-3.1,AU-12(a),AU-12.1(ii),AU-12.1(iv)
srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-APP-000495-CTR-001235,SRG-OS-000755-GPOS-00220
stigid@sle15: SLES-15-030330
stigid@ubuntu2404: UBTU-24-900180

{{{ ocil_fix_srg_privileged_command("sudoedit") }}}

Expand Down
Loading
Loading