The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.
#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel7:def:552
# The Red Hat Enterprise Linux operating system must audit all uses of the chown, fchown, fchownat, and lchown syscalls.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
# audit augenrules
# textfilecontent54_object (textfilecontent54_test)
test_1() {
grep -Pq '^ExecStartPost=\-\/sbin\/augenrules.*$' '/usr/lib/systemd/system/auditd.service' &>/dev/null
}
# audit augenrules 32-bit chown
# textfilecontent54_object (textfilecontent54_test)
test_2() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit fchown
# textfilecontent54_object (textfilecontent54_test)
test_3() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset|-1)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit fchownat
# textfilecontent54_object (textfilecontent54_test)
test_4() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit lchown
# textfilecontent54_object (textfilecontent54_test)
test_5() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# Generic test for x86_64 architecture
# uname_object (uname_test)
test_6() {
(uname -p) | grep -qxF 'x86_64'
}
# Generic test for ppc64 architecture
# uname_object (uname_test)
test_7() {
(uname -p) | grep -qxF 'ppc64'
}
# Generic test for ppcle64 architecture
# uname_object (uname_test)
test_8() {
(uname -p) | grep -qxF 'ppc64le'
}
# audit augenrules 64-bit chown
# textfilecontent54_object (textfilecontent54_test)
test_9() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit fchown
# textfilecontent54_object (textfilecontent54_test)
test_10() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset|-1)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit fchownat
# textfilecontent54_object (textfilecontent54_test)
test_11() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit lchown
# textfilecontent54_object (textfilecontent54_test)
test_12() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit auditctl
# textfilecontent54_object (textfilecontent54_test)
test_13() {
grep -Pq '^ExecStartPost=\-\/sbin\/auditctl.*$' '/usr/lib/systemd/system/auditd.service' &>/dev/null
}
# audit auditctl 32-bit chown
# textfilecontent54_object (textfilecontent54_test)
test_14() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit fchown
# textfilecontent54_object (textfilecontent54_test)
test_15() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset|-1)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit fchownat
# textfilecontent54_object (textfilecontent54_test)
test_16() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit lchown
# textfilecontent54_object (textfilecontent54_test)
test_17() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# Generic test for x86_64 architecture
# uname_object (uname_test)
test_18() {
(uname -p) | grep -qxF 'x86_64'
}
# Generic test for ppc64 architecture
# uname_object (uname_test)
test_19() {
(uname -p) | grep -qxF 'ppc64'
}
# Generic test for ppcle64 architecture
# uname_object (uname_test)
test_20() {
(uname -p) | grep -qxF 'ppc64le'
}
# audit auditctl 64-bit chown
# textfilecontent54_object (textfilecontent54_test)
test_21() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit fchown
# textfilecontent54_object (textfilecontent54_test)
test_22() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset|-1)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit fchownat
# textfilecontent54_object (textfilecontent54_test)
test_23() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit lchown
# textfilecontent54_object (textfilecontent54_test)
test_24() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
if ( ( test_1 && test_2 && test_3 && test_4 && test_5 && ( test_6 || test_7 || test_8 || test_9 || test_10 || test_11 || test_12 ) ) || ( test_13 && test_14 && test_15 && test_16 && test_17 && ( test_18 || test_19 || test_20 || test_21 || test_22 || test_23 || test_24 ) ) ); then
echo "PASS"
else
echo "FAIL"
fi