scap-security-guide/scap-security-guide-0.1.63-audit_access_success_unenforcing-PR_9082.patch
Vojtech Polasek b76ea12151 make audit_access_success unenforcing for rhel9 ospp
Resolves: rhbz#2058154
2022-07-18 15:27:04 +02:00

28 lines
1.0 KiB
Diff

From fd1f968504765db0ba5c32ac50058d7a05242343 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Fri, 1 Jul 2022 14:35:56 +0200
Subject: [PATCH] Make rule audit_access_success in OSPP profile unenforcing
Set severity to info and role to unscored, because the rule
creates an audit rule that creates generating huge amounts
of audit records generated.
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2058154
---
products/rhel9/profiles/ospp.profile | 2 ++
1 file changed, 2 insertions(+)
diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile
index 1fad0031749..8e54ae4281d 100644
--- a/products/rhel9/profiles/ospp.profile
+++ b/products/rhel9/profiles/ospp.profile
@@ -372,6 +372,8 @@ selections:
- audit_modify_success
- audit_access_failed
- audit_access_success
+ - audit_access_success.severity=info
+ - audit_access_success.role=unscored
- audit_delete_failed
- audit_delete_success
- audit_perm_change_failed