Move RHEL-08-030610 to RHEL-09-653110 to use 0600 for audit files

components/audit.yml

@@ -1,5 +1,5 @@
 groups:
 - audit_dac_actions
 - audit_execution_acl_commands
 - audit_execution_selinux_commands
 - audit_file_deletion_events
@@ -13,12 +13,12 @@
 - configure_auditd_data_retention
 name: audit
 packages:
 - audispd-plugins
 - audit
 - audit-audispd-plugins
 - audit-libs
 rules:
 - audit_access_failed
 - audit_access_failed_aarch64
 - audit_access_failed_ppc64le
 - audit_access_success
@@ -326,7 +326,9 @@
 - file_ownership_var_log_audit
 - file_ownership_var_log_audit_stig
 - file_permissions_audit_configuration
+- file_permissions_audit_configuration_stig
 - file_permissions_etc_audit_auditd
+- file_permissions_etc_audit_auditd_stig
 - file_permissions_etc_audit_rulesd
 - file_permissions_etc_audit_rules
 - file_permissions_var_log_audit
@@ -341,7 +343,7 @@
 - audit_rules_etc_cron_d
 - audit_rules_var_spool_cron
 templates:
 - audit_file_contents
 - audit_rules_dac_modification
 - audit_rules_file_deletion_events
 - audit_rules_login_events

linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/policy/stig/shared.yml

@@ -0,0 +1,21 @@
+srg_requirement: |-
+    {{{ full_name }}} must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
+
+fixtext: |-
+    Configure the files in directory "/etc/audit/rules.d/" and the "/etc/audit/auditd.conf" file to have a mode of "0600" with the following commands:
+
+    $ sudo chmod 0600 /etc/audit/rules.d/audit.rules
+    $ sudo chmod 0600 /etc/audit/rules.d/[customrulesfile].rules
+    $ sudo chmod 0600 /etc/audit/auditd.conf
+
+checktext: |-
+    Verify that the files in directory "/etc/audit/rules.d/" and "/etc/audit/auditd.conf" file have a mode of "0600" or less permissive with the following command:
+
+    $ sudo find /etc/audit/rules.d/ /etc/audit/audit.rules /etc/audit/auditd.conf -type f -exec stat -c "%a %n" {} \;
+
+    600 /etc/audit/rules.d/audit.rules
+    600 /etc/audit/audit.rules
+    600 /etc/audit/auditd.conf
+
+vuldiscussion: |-
+    Without the capability to restrict the roles and individuals that can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audits may degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.

linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/rule.yml

@@ -0,0 +1,42 @@
+documentation_complete: true
+
+title: 'Audit Configuration Files Permissions are 600 or More Restrictive'
+
+description: |-
+    All audit configuration files permissions must be 600 or more restrictive.
+    <pre>chmod 0600 /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*</pre>
+
+rationale: |-
+    Without the capability to restrict which roles and individuals can
+    select which events are audited, unauthorized personnel may be able
+    to prevent the auditing of critical events.
+    Misconfigured audits may degrade the system's performance by
+    overwhelming the audit log. Misconfigured audits may also make it more
+    difficult to establish, correlate, and investigate the events relating
+    to an incident or identify those responsible for one.
+
+severity: medium
+
+identifiers:
+    cce@rhel8: CCE-89815-5
+    cce@rhel9: CCE-88792-7
+
+references:
+    nist: AU-12 b
+    srg: SRG-OS-000063-GPOS-00032
+
+ocil: |-
+    {{{ describe_file_permissions(file="/etc/audit/", perms="0600") }}}
+    {{{ describe_file_permissions(file="/etc/audit/rules.d/", perms="0600") }}}
+
+template:
+    name: file_permissions
+    vars:
+        filepath:
+            - /etc/audit/
+            - /etc/audit/rules.d/
+        file_regex:
+            - ^.*audit(\.rules|d\.conf)$
+            - ^.*\.rules$
+        allow_stricter_permissions: "true"
+        filemode: '0600'

linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/tests/correct_permissions.pass.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# packages = audit
+
+export TESTFILE=/etc/audit/rules.d/test_rule.rules
+export AUDITFILE=/etc/audit/auditd.conf
+touch $TESTFILE
+touch $AUDITFILE
+chmod 0600 $TESTFILE
+chmod 0600 $AUDITFILE

linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/tests/lenient_permissions.fail.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# packages = audit
+
+export TESTFILE=/etc/audit/rules.d/test_rule.rules
+export AUDITFILE=/etc/audit/auditd.conf
+touch $TESTFILE
+touch $AUDITFILE
+chmod 0640 $TESTFILE
+chmod 0640 $AUDITFILE

linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/tests/stricter_permisions.pass.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# packages = audit
+
+export TESTFILE=/etc/audit/rules.d/test_rule.rules
+export AUDITFILE=/etc/audit/auditd.conf
+touch $TESTFILE
+touch $AUDITFILE
+chmod 0400 $TESTFILE
+chmod 0400 $AUDITFILE

linux_os/guide/auditing/file_permissions_auditd/file_permissions_etc_audit_auditd_stig/policy/stig/shared.yml

@@ -0,0 +1,19 @@
+srg_requirement: |-
+    {{{ full_name }}} /etc/audit/auditd.conf file must have 0600 or less permissive to prevent unauthorized access.
+
+vuldiscussion: |-
+    Without the capability to restrict the roles and individuals that can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audits may degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
+
+checktext: |-
+    Verify the mode of /etc/audit/auditd.conf with the command:
+
+    $ sudo stat -c "%a %n" /etc/audit/auditd.conf
+
+    600 /etc/audit/auditd.conf
+
+    If "/etc/audit/auditd.conf" does not have a mode of "0600", this is a finding.
+
+fixtext: |-
+    Set the mode of /etc/audit/auditd.conf file to 0600 with the command:
+
+    $ sudo chmod 0600 /etc/audit/auditd.conf

linux_os/guide/auditing/file_permissions_auditd/file_permissions_etc_audit_auditd_stig/rule.yml

@@ -0,0 +1,43 @@
+documentation_complete: true
+
+
+title: 'Verify Permissions on /etc/audit/auditd.conf'
+
+description: |-
+    {{{ describe_file_permissions(file="/etc/audit/auditd.conf", perms="0600") }}}
+
+
+rationale: |-
+    Without the capability to restrict the roles and individuals that can select which events
+    are audited, unauthorized personnel may be able to prevent the auditing of critical
+    events. Misconfigured audits may degrade the system's performance by overwhelming
+    the audit log. Misconfigured audits may also make it more difficult to establish,
+    correlate, and investigate the events relating to an incident or identify
+    those responsible for one.
+
+severity: medium
+
+identifiers:
+    cce@rhel8: CCE-89841-1
+    cce@rhel9: CCE-88950-1
+
+references:
+    nist: AU-12(b)
+    srg: SRG-OS-000063-GPOS-00032
+
+ocil_clause: '{{{ ocil_clause_file_permissions(file="/etc/audit/auditd.conf", perms="-rw-------") }}}'
+
+ocil: |-
+    {{{ ocil_file_permissions(file="/etc/audit/auditd.conf", perms="-rw-------") }}}
+
+fixtext: |-
+    {{{ describe_file_permissions(file="/etc/audit/auditd.conf", perms="0600") }}}
+
+srg_requirement: '{{{ srg_requirement_file_permission(file="/etc/audit/auditd.conf", mode="0600")}}}'
+
+template:
+    name: file_permissions
+    vars:
+      filepath: /etc/audit/auditd.conf
+      allow_stricter_permissions: "true"
+      filemode: '0600'

products/rhel8/controls/stig_rhel8.yml

@@ -1981,8 +1981,8 @@ controls:
       title: RHEL 8 must allow only the Information System Security Manager (ISSM) (or individuals or
           roles appointed by the ISSM) to select which auditable events are to be audited.
       rules:
-          - file_permissions_etc_audit_auditd
-          - file_permissions_etc_audit_rulesd
+          - file_permissions_etc_audit_auditd_stig
+          - file_permissions_audit_configuration_stig
       status: automated
 
     - id: RHEL-08-030620

products/rhel8/profiles/default.profile

@@ -739,3 +739,5 @@ selections:
     - sshd_use_approved_kex_ordered_stig
     - accounts_user_dot_no_world_writable_programs
     - package_dnsmasq_removed
+    - file_permissions_etc_audit_rulesd
+    - file_permissions_etc_audit_auditd

products/rhel9/controls/stig_rhel9.yml

@@ -3403,8 +3403,8 @@ controls:
           or
           roles appointed by the ISSM) to select which auditable events are to be audited.
       rules:
-          - file_permissions_audit_configuration
-          - file_permissions_etc_audit_auditd
+          - file_permissions_audit_configuration_stig
+          - file_permissions_etc_audit_auditd_stig
       status: automated
 
     - id: RHEL-09-653120

products/rhel9/profiles/default.profile

@@ -594,3 +594,4 @@ selections:
     - configure_ssh_crypto_policy
     - accounts_user_dot_no_world_writable_programs
     - package_dnsmasq_removed
+    - file_permissions_etc_audit_auditd

shared/references/cce-redhat-avail.txt

@@ -1173,7 +1173,6 @@ CCE-88787-7
 CCE-88788-5
 CCE-88790-1
 CCE-88791-9
-CCE-88792-7
 CCE-88794-3
 CCE-88795-0
 CCE-88798-4
@@ -1251,7 +1250,6 @@ CCE-88944-4
 CCE-88945-1
 CCE-88946-9
 CCE-88949-3
-CCE-88950-1
 CCE-88951-9
 CCE-88952-7
 CCE-88953-5
@@ -1749,7 +1747,6 @@ CCE-89806-4
 CCE-89810-6
 CCE-89812-2
 CCE-89814-8
-CCE-89815-5
 CCE-89817-1
 CCE-89818-9
 CCE-89819-7
@@ -1769,7 +1766,6 @@ CCE-89837-9
 CCE-89838-7
 CCE-89839-5
 CCE-89840-3
-CCE-89841-1
 CCE-89845-2
 CCE-89846-0
 CCE-89847-8

tests/data/profile_stability/rhel8/stig.profile

@@ -194,9 +194,9 @@ file_ownership_binary_dirs
 file_ownership_library_dirs
 file_ownership_var_log_audit_stig
 file_permission_user_init_files_root
+file_permissions_audit_configuration_stig
 file_permissions_binary_dirs
-file_permissions_etc_audit_auditd
-file_permissions_etc_audit_rulesd
+file_permissions_etc_audit_auditd_stig
 file_permissions_home_directories
 file_permissions_library_dirs
 file_permissions_sshd_private_key

tests/data/profile_stability/rhel8/stig_gui.profile

@@ -194,9 +194,9 @@ file_ownership_binary_dirs
 file_ownership_library_dirs
 file_ownership_var_log_audit_stig
 file_permission_user_init_files_root
+file_permissions_audit_configuration_stig
 file_permissions_binary_dirs
-file_permissions_etc_audit_auditd
-file_permissions_etc_audit_rulesd
+file_permissions_etc_audit_auditd_stig
 file_permissions_home_directories
 file_permissions_library_dirs
 file_permissions_sshd_private_key

tests/data/profile_stability/rhel9/stig.profile

@@ -247,14 +247,14 @@ file_ownership_audit_configuration
 file_ownership_binary_dirs
 file_ownership_library_dirs
 file_permission_user_init_files_root
-file_permissions_audit_configuration
+file_permissions_audit_configuration_stig
 file_permissions_backup_etc_group
 file_permissions_backup_etc_gshadow
 file_permissions_backup_etc_passwd
 file_permissions_backup_etc_shadow
 file_permissions_binary_dirs
 file_permissions_cron_not_modified
-file_permissions_etc_audit_auditd
+file_permissions_etc_audit_auditd_stig
 file_permissions_etc_group
 file_permissions_etc_gshadow
 file_permissions_etc_passwd

tests/data/profile_stability/rhel9/stig_gui.profile

@@ -247,14 +247,14 @@ file_ownership_audit_configuration
 file_ownership_binary_dirs
 file_ownership_library_dirs
 file_permission_user_init_files_root
-file_permissions_audit_configuration
+file_permissions_audit_configuration_stig
 file_permissions_backup_etc_group
 file_permissions_backup_etc_gshadow
 file_permissions_backup_etc_passwd
 file_permissions_backup_etc_shadow
 file_permissions_binary_dirs
 file_permissions_cron_not_modified
-file_permissions_etc_audit_auditd
+file_permissions_etc_audit_auditd_stig
 file_permissions_etc_group
 file_permissions_etc_gshadow
 file_permissions_etc_passwd