From 12bbbb2c006c6e58f00a328802a216318fec9e4c Mon Sep 17 00:00:00 2001 From: Andrew Davison Date: Fri, 19 Apr 2024 14:38:07 +0100 Subject: [PATCH] Correct 4.1.15 sudo audit syntax Signed-off-by: Andrew Davison --- templates/audit/99_auditd.rules.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/audit/99_auditd.rules.j2 b/templates/audit/99_auditd.rules.j2 index 19eb0be..24ca3c0 100644 --- a/templates/audit/99_auditd.rules.j2 +++ b/templates/audit/99_auditd.rules.j2 @@ -66,8 +66,8 @@ -w /etc/sudoers.d/ -p wa -k scope {% endif %} {% if amazon2cis_rule_4_1_15 %} --a exit,always -F arch=b64 -C euid!=uid -F euid=0 -Fauid>=1000 -F auid!=4294967295 -S execve -k actions --a exit,always -F arch=b32 -C euid!=uid -F euid=0 -Fauid>=1000 -F auid!=4294967295 -S execve -k actions +-a always,exit -F arch=b64 -C euid!=uid -F euid=0 -F auid>=1000 -F auid!=4294967295 -S execve -k actions +-a always,exit -F arch=b32 -C euid!=uid -F euid=0 -F auid>=1000 -F auid!=4294967295 -S execve -k actions {% endif %} {% if amazon2cis_rule_4_1_16 %} -w /sbin/insmod -p x -k modules