Skip to content

False positives for 6.3.3.17 #61

Open
@kodebach

Description

@kodebach

Describe the Issue
The check for 6.3.3.17 doesn't work, I assume because it tries to use -k instead of -F key=

Control(s) Affected
6.3.3.17 | Ensure successful and unsuccessful attempts to use the chacl command are recorded | running

Additional Notes

I think -k perm_chng should be -F key=perm_chng

- '-a always,exit -S all -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=(unset|-1|auid!=4294967295) -k perm_chng'

as it is here for example

- '/-a always,exit -S all -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=(unset|-1|4294967295) -F key=perm_chng/'

Possibly also the / / around the stdout line are required.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions