Skip to content

Commit cca7280

Browse files
committed
fix unix_update path for UBTU-20-010173
This commit will fix the unix_update path for UBTU-20-010173 which is specified on DISA STIG to be /sbin/unix_update
1 parent 7ffb568 commit cca7280

File tree

1 file changed

+9
-2
lines changed
  • linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_unix_update

1 file changed

+9
-2
lines changed

linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_unix_update/rule.yml

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
{{%- if product in ["ubuntu2004"] %}}
2+
{{%- set unix_update_path="/sbin/unix_update" %}}
3+
{{%- else %}}
4+
{{%- set unix_update_path="/usr/sbin/unix_update" %}}
5+
{{%- endif %}}
6+
17
documentation_complete: true
28

39
prodtype: ol8,ol9,rhel8,rhel9,ubuntu2004,ubuntu2204
@@ -10,11 +16,11 @@ description: |-
1016
configured to use the <tt>augenrules</tt> program to read audit rules during
1117
daemon startup (the default), add a line of the following form to a file with
1218
suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
13-
<pre>-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid&gt;={{{ auid }}} -F auid!=unset -F key=privileged</pre>
19+
<pre>-a always,exit -F path={{{ unix_update_path }}} -F perm=x -F auid&gt;={{{ auid }}} -F auid!=unset -F key=privileged</pre>
1420
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
1521
utility to read audit rules during daemon startup, add a line of the following
1622
form to <tt>/etc/audit/audit.rules</tt>:
17-
<pre>-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid&gt;={{{ auid }}} -F auid!=unset -F key=privileged</pre>
23+
<pre>-a always,exit -F path={{{ unix_update_path }}} -F perm=x -F auid&gt;={{{ auid }}} -F auid!=unset -F key=privileged</pre>
1824
1925
rationale: |-
2026
Misuse of privileged functions, either intentionally or unintentionally by
@@ -47,3 +53,4 @@ template:
4753
name: audit_rules_privileged_commands
4854
vars:
4955
path: /usr/sbin/unix_update
56+
path@ubuntu2004: /sbin/unix_update

0 commit comments

Comments
 (0)