From 11ef40118740370e6329445d8430de6902af324e Mon Sep 17 00:00:00 2001
From: Sam Marshall <sam@foundu.com.au>
Date: Tue, 16 Jul 2019 12:07:07 +1000
Subject: [PATCH] Allow for lowercase auditd config flush value.

Signed-off-by: Sam Marshall <sam@foundu.com.au>
---
 controls/package_spec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/controls/package_spec.rb b/controls/package_spec.rb
index 9dade7b..8856923 100644
--- a/controls/package_spec.rb
+++ b/controls/package_spec.rb
@@ -97,7 +97,7 @@
   describe auditd_conf do
     its('log_file') { should cmp '/var/log/audit/audit.log' }
     its('log_format') { should cmp 'raw' }
-    its('flush') { should match(/^INCREMENTAL|INCREMENTAL_ASYNC$/) }
+    its('flush') { should match(/^incremental|INCREMENTAL|incremental_async|INCREMENTAL_ASYNC$/) }
     its('max_log_file_action') { should cmp 'keep_logs' }
     its('space_left') { should cmp 75 }
     its('action_mail_acct') { should cmp 'root' }