What changed in Canonical Ubuntu 18.04 LTS SCAP Benchmark V2R12V2R12 changes

Check text

AND - auditd package is installed dpkginfo_test (check: all, existence: all_exist) object dpkginfo_object: name equals "auditd" - check for running auditd process58_test (check: all, existence: at_least_one_exists) object process58_object: command_line pattern match "^\\/sbin\\/auditd\\b"; pid greater than "1" - Audit invocations of /usr/bin/chacl textfilecontent54_test (check: all, existence: all_exist) object textfilecontent54_object: filepath equals "/etc/audit/audit.rules"; pattern pattern match "^\\s*-a\\s+(always,exit|exit,always)\\s+-F\\s+path=/usr/bin/chacl\\s+(-F\\s+perm=([rwa]*x[rwa]*)\\s+)?-F\\s+auid>=1000\\s+-F\\s+auid!=(4294967295|unset|-1)\\s+((-k\\s+|-F\\s+key=)\\S+\\s*)?$"; instance greater than or equal "1" Verify the Ubuntu operating system generates an audit record when successful/unsuccessful attempts to use the "chacl" command occur. Check the currently configured audit rules with the following command: # sudo audtctlauditctl -l | grep chacl -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=-1 -k perm_chng If the command does not return a line that matches the example or the line is commented out, this is a finding. Note: The '-k' allows for specifying an arbitrary identifier and the string after it does not need to match the example output above. If the command does not return a line that matches the example or the line is commented out, this is a finding.

V-219270 in V2R12