[bugfix] update audit-syscall-check-macro for RHEL 6&7 #317
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Thank you to Jermaine Glass for reporting!
There was a change of auditctl output syntax between RHEL 6.5 and RHEL 6.6. Namely:
RHEL 6.5
auditctl -l | grep syscall | grep adjtimex
LIST_RULES: exit,always arch=1073741827 (0x40000003) key=audit_time_rules
syscall=adjtimex
LIST_RULES: exit,always arch=3221225534 (0xc000003e) key=audit_time_rules
syscall=adjtimex
RHEL 6.6
auditctl -l | grep syscall | grep adjtimex
<== No output
auditctl -l | grep adjtimex | grep audit_time_rule
-a always,exit -F arch=i386 -S stime,settimeofday,adjtimex -F
key=audit_time_rules
-a always,exit -F arch=x86_64 -S adjtimex,settimeofday,clock_settime -F
key=audit_time_rules
Went to update the audit macro, then (as Steve Grubb outlined) auditctl checks the runtime of the system, whereas the control
is meant to check static (/etc/audit/audit.rules). Updated macro to grep audit.rules vs use auditctl.