OPENSCAP-4927 - Update audit_rules_media_export

[jan-cerny]

• Update rule description because if you are on 64 bit architecture you should add 2 lines of audit rules - one with b32 and one with b64.
• Align remediations, checks, tests, etc. with the rule description
• Resolve inconsistencies with audit key.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_media_export'.
--- xccdf_org.ssgproject.content_rule_audit_rules_media_export
+++ xccdf_org.ssgproject.content_rule_audit_rules_media_export
@@ -7,13 +7,15 @@
 events for all users and root. If the auditd daemon is configured to
 use the augenrules program to read audit rules during daemon startup
 (the default), add the following line to a file with suffix .rules in
-the directory /etc/audit/rules.d, setting ARCH to either b32 or b64 as
-appropriate for your system:
+the directory /etc/audit/rules.d, setting ARCH to either b32 for
+32-bit system, or having two lines for both b32 and b64 in case your
+system is 64-bit:
 -a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=unset -F key=export
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add the following line to
-/etc/audit/audit.rules file, setting ARCH to either b32 or b64 as
-appropriate for your system:
+/etc/audit/audit.rules file, setting ARCH to either b32 for
+32-bit system, or having two lines for both b32 and b64 in case your
+system is 64-bit:
 -a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=unset -F key=export
 
 [reference]:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_media_export' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_media_export
+++ xccdf_org.ssgproject.content_rule_audit_rules_media_export
@@ -11,7 +11,7 @@
 	OTHER_FILTERS=""
 	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
 	SYSCALL="mount"
-	KEY="perm_mod"
+	KEY="export"
 	SYSCALL_GROUPING=""
 
 	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_media_export' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_media_export
+++ xccdf_org.ssgproject.content_rule_audit_rules_media_export
@@ -92,8 +92,8 @@
       | last).key }}"
     when: found_paths | length >= 1
 
-  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
-    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
+  - name: No file with syscall found, set path to /etc/audit/rules.d/export.rules
+    set_fact: audit_file="/etc/audit/rules.d/export.rules"
     when: found_paths | length == 0
 
   - name: Declare found syscalls
@@ -119,7 +119,7 @@
     lineinfile:
       path: '{{ audit_file }}'
       line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
-        -F auid!=unset -F key=perm_mod
+        -F auid!=unset -F key=export
       create: true
       mode: g-rwx,o-rwx
       state: present
@@ -166,7 +166,7 @@
     lineinfile:
       path: '{{ audit_file }}'
       line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
-        -F auid!=unset -F key=perm_mod
+        -F auid!=unset -F key=export
       create: true
       mode: g-rwx,o-rwx
       state: present
@@ -237,8 +237,8 @@
       | last).key }}"
     when: found_paths | length >= 1
 
-  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
-    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
+  - name: No file with syscall found, set path to /etc/audit/rules.d/export.rules
+    set_fact: audit_file="/etc/audit/rules.d/export.rules"
     when: found_paths | length == 0
 
   - name: Declare found syscalls
@@ -264,7 +264,7 @@
     lineinfile:
       path: '{{ audit_file }}'
       line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
-        -F auid!=unset -F key=perm_mod
+        -F auid!=unset -F key=export
       create: true
       mode: g-rwx,o-rwx
       state: present
@@ -311,7 +311,7 @@
     lineinfile:
       path: '{{ audit_file }}'
       line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
-        -F auid!=unset -F key=perm_mod
+        -F auid!=unset -F key=export
       create: true
       mode: g-rwx,o-rwx
       state: present

[codeclimate]

Code Climate has analyzed commit 55feef6 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.9% (0.0% change).

View more on Code Climate.

[vojtapolasek]

/packit retest-failed

[vojtapolasek]

LGTM, I have only minor request, see the specific comment.

[vojtapolasek]

I think you should leave blank lines around list items.