OpenSCAP/scap-security-guide — pull request #345 by iankko (2014-12-05 13:59:47+00:00)
Title: [BugFix] [Enhancement] [RHEL/6] audit file system watch rules remediations

This proposal does the following:
* patch 1 ```audit_rules_time_watch_localtime``` rule:
* introduce new RHEL-6 remediation functions library to be placed under: ```/usr/share/scap-security-guide/functions``` path into the RPM (to share remediation functions implementation)
* introduce ```fix_audit_watch_rule``` function which can be used to remediate audit file system watch
rules, e.g. those having the expected form: ```-w file_path -p access_mode -k audit_search_key```
* apply that remediation function to implement RHEL-6 remediation for audit_time_rules_watch_localtime rule

* patch 2 ```Record Events that Modify User/Group Information``` audit rule:
* unify XCCDF ID with OVAL ID (in xccdf & profile references),
* implement RHEL-6 remediation (using the ```fix_audit_watch_rule``` remediation function)

* patch 3 ```Record Events that Modify User/Group Information``` audit rule:
* bugfix the OVAL check - allow 'aw' together with 'wa' access type (since they are equivalent),
* enhancement OVAL check - allow stronger access type containing 'wa/aw' as minimum (e.g. make the check to PASS even when system administrator wants to audit also 'rx' events, IOW when the final access mask is 'rxaw'

* patch 4 ```audit_mac_changes``` rule:
* unify XCCDF ID with OVAL ID (in xccdf & profile references),
* fix the OVAL check to allow 'aw' or stronger access types (e.g. 'rxaw'),
* add RHEL-6 remediation,

* patch 5 ```audit_rules_sysadmin_actions``` rule:
* unify XCCDF ID with OVAL id (in xccdf & profile references),
* fix the OVAL check to use the template regex from audit_rules_time_watch_localtime (IOW it to allow to pass also 'aw' or stronger e.g. 'rxwa' access masks,
* implement RHEL-6 remediation for this rule (utilizing the ```fix_audit_watch_rule``` function).

Testing report:
--
The proposed change has been tested on RHEL-6 on both archs (32-bit & 64-bit) & works as expected for all four rules (particular rule is referenced under new OVAL name, the OVAL check allows access type to contain 'aw' or something stronger e.g ' xaw' or 'rawx' - the order doesn't matter, & provided remediation scripts work for each of them - when not present, they are added, when particular file path already present in ```/etc/audit/audit.rules```, but not with 'aw | wa' access type, the -p value is updated the rule to meet the requirements).

Please review.

Thank you, Jan.