From 6be121cd613c2fceb27ab219051973cd9aee778e Mon Sep 17 00:00:00 2001 From: Bob Gendler Date: Fri, 10 Feb 2023 10:42:12 -0500 Subject: [PATCH] refactor[rules] Updated check to match ventura Updated audit_control_mode_configure check --- rules/audit/audit_control_mode_configure.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/audit/audit_control_mode_configure.yaml b/rules/audit/audit_control_mode_configure.yaml index 515fe6e7..c181c364 100644 --- a/rules/audit/audit_control_mode_configure.yaml +++ b/rules/audit/audit_control_mode_configure.yaml @@ -3,7 +3,7 @@ title: "Configure Audit_Control Owner to Mode 440 or Less Permissive" discussion: | /etc/security/audit_control _MUST_ be configured so that it is readable only by the root user and group wheel. check: | - /bin/ls -l /etc/security/audit_control | awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/xargs + /bin/ls -l /etc/security/audit_control | /usr/bin/awk '!/-r--[r-]-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/xargs result: integer: 0 fix: |