OpenSCAP/scap-security-guide — pull request #317 by shawndwells (2014-10-29 01:48:29+00:00)
Title: [bugfix] update audit-syscall-check-macro for RHEL 6&7

Thank you to Jermaine Glass for reporting!

There was a change of auditctl output syntax between RHEL 6.5 and RHEL 6.6. Namely:

RHEL 6.5
---------
auditctl -l | grep syscall | grep adjtimex
LIST_RULES: exit,always arch=1073741827 (0x40000003) key=audit_time_rules
syscall=adjtimex
LIST_RULES: exit,always arch=3221225534 (0xc000003e) key=audit_time_rules
syscall=adjtimex

RHEL 6.6
--------
auditctl -l | grep syscall | grep adjtimex
<== No output

auditctl -l | grep adjtimex | grep audit_time_rule
-a always,exit -F arch=i386 -S stime,settimeofday,adjtimex -F
key=audit_time_rules
-a always,exit -F arch=x86_64 -S adjtimex,settimeofday,clock_settime -F
key=audit_time_rules

Went to update the audit macro, then (as Steve Grubb outlined) auditctl checks the *runtime* of the system, whereas the control
is meant to check static (/etc/audit/audit.rules). Updated macro to grep audit.rules vs use auditctl.