The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.
#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel7:def:607
# The Red Hat Enterprise Linux operating system must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr syscalls.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
# audit augenrules
# textfilecontent54_object (textfilecontent54_test)
test_1() {
grep -Pq '^ExecStartPost=\-\/sbin\/augenrules.*$' '/usr/lib/systemd/system/auditd.service' &>/dev/null
}
# audit augenrules 32-bit setxattr
# textfilecontent54_object (textfilecontent54_test)
test_2() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit lremovexattr
# textfilecontent54_object (textfilecontent54_test)
test_3() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit lsetxattr
# textfilecontent54_object (textfilecontent54_test)
test_4() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit removexattr
# textfilecontent54_object (textfilecontent54_test)
test_5() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit fremovexattr
# textfilecontent54_object (textfilecontent54_test)
test_6() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit fsetxattr
# textfilecontent54_object (textfilecontent54_test)
test_7() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# Generic test for x86_64 architecture
# uname_object (uname_test)
test_8() {
(uname -p) | grep -qxF 'x86_64'
}
# Generic test for ppc64 architecture
# uname_object (uname_test)
test_9() {
(uname -p) | grep -qxF 'ppc64'
}
# Generic test for ppcle64 architecture
# uname_object (uname_test)
test_10() {
(uname -p) | grep -qxF 'ppc64le'
}
# audit augenrules 64-bit setxattr
# textfilecontent54_object (textfilecontent54_test)
test_11() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit lremovexattr
# textfilecontent54_object (textfilecontent54_test)
test_12() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit lsetxattr
# textfilecontent54_object (textfilecontent54_test)
test_13() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit removexattr
# textfilecontent54_object (textfilecontent54_test)
test_14() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit fremovexattr
# textfilecontent54_object (textfilecontent54_test)
test_15() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit fsetxattr
# textfilecontent54_object (textfilecontent54_test)
test_16() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit auditctl
# textfilecontent54_object (textfilecontent54_test)
test_17() {
grep -Pq '^ExecStartPost=\-\/sbin\/auditctl.*$' '/usr/lib/systemd/system/auditd.service' &>/dev/null
}
# audit auditctl 32-bit setxattr
# textfilecontent54_object (textfilecontent54_test)
test_18() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit lremovexattr
# textfilecontent54_object (textfilecontent54_test)
test_19() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit lsetxattr
# textfilecontent54_object (textfilecontent54_test)
test_20() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit removexattr
# textfilecontent54_object (textfilecontent54_test)
test_21() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit fremovexattr
# textfilecontent54_object (textfilecontent54_test)
test_22() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit fsetxattr
# textfilecontent54_object (textfilecontent54_test)
test_23() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# Generic test for x86_64 architecture
# uname_object (uname_test)
test_24() {
(uname -p) | grep -qxF 'x86_64'
}
# Generic test for ppc64 architecture
# uname_object (uname_test)
test_25() {
(uname -p) | grep -qxF 'ppc64'
}
# Generic test for ppcle64 architecture
# uname_object (uname_test)
test_26() {
(uname -p) | grep -qxF 'ppc64le'
}
# audit auditctl 64-bit setxattr
# textfilecontent54_object (textfilecontent54_test)
test_27() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit lremovexattr
# textfilecontent54_object (textfilecontent54_test)
test_28() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit lsetxattr
# textfilecontent54_object (textfilecontent54_test)
test_29() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit removexattr
# textfilecontent54_object (textfilecontent54_test)
test_30() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit fremovexattr
# textfilecontent54_object (textfilecontent54_test)
test_31() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit fsetxattr
# textfilecontent54_object (textfilecontent54_test)
test_32() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
if ( ( test_1 && test_2 && test_3 && test_4 && test_5 && test_6 && test_7 && ( test_8 || test_9 || test_10 || test_11 || test_12 || test_13 || test_14 || test_15 || test_16 ) ) || ( test_17 && test_18 && test_19 && test_20 && test_21 && test_22 && test_23 && ( test_24 || test_25 || test_26 || test_27 || test_28 || test_29 || test_30 || test_31 || test_32 ) ) ); then
echo "PASS"
else
echo "FAIL"
fi Assessment Script Powered by AISandbox-executed
A standalone Shell script to assess this control automatically. Review before running it in your environment.
Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.
#!/bin/sh
# OVAL Definition: oval:mil.disa.stig.rhel7:def:607
if [ ! -f /usr/lib/systemd/system/auditd.service ]; then echo "PASS"; exit 0; fi
if [ ! -s /etc/audit/rules.d/audit.rules ]; then echo "PASS"; exit 0; fi
grep -q "^[\\s]*-a[\\s]+always,exit[\\s]+(?:.*-F[\\s]+arch=b32[\\s]+)(?:.*(-S[\\s]+setxattr[\\s]+|([\\s]+|[,])setxattr([\\s]+|[,]))(?:.*-F\\s+auid>=1000[\\s]+)(?:.*-F\\s+auid != (?:4294967295|-1|unset)[\\s]+).*(-k[\\s]+|-F[\\s]+key=)[-\\w]+[\\s]*$" /etc/audit/rules.d/audit.rules && grep -q "^[\\s]*-a[\\s]+always,exit[\\s]+(?:.*-F[\\s]+arch=b32[\\s]+)(?:.*(-S[\\s]+removexattr[\\s]+|([\\s]+|[,])removexattr([\\s]+|[,]))(?:.*-F\\s+auid>=1000[\\s]+)(?:.*-F\\s+auid != (?:4294967295|-1|unset)[\\s]+).*(-k[\\s]+|-F[\\s]+key=)[-\\w]+[\\s]*$" /etc/audit/rules.d/audit.rules && grep -q "^[\\s]*-a[\\s]+always,exit[\\s]+(?:.*-F[\\s]+arch=b32[\\s]+)(?:.*(-S[\\s]+lsetxattr[\\s]+|([\\s]+|[,])lsetxattr([\\s]+|[,]))(?:.*-F\\s+auid>=1000[\\s]+)(?:.*-F\\s+auid != (?:4294967295|-1|unset)[\\s]+).*(-k[\\s]+|-F[\\s]+key=)[-\\w]+[\\s]*$" /etc/audit/rules.d/audit.rules && grep -q "^[\\s]*-a[\\s]+always,exit[\\s]+(?:.*-F[\\s]+arch=b32[\\s]+)(?:.*(-S[\\s]+lremovexattr[\\s]+|([\\s]+|[,])lremovexattr([\\s]+|[,]))(?:.*-F\\s+auid>=1000[\\s]+)(?:.*-F\\s+auid != (?:4294967295|-1|unset)[\\s]+).*(-k[\\s]+|-F[\\s]+key=)[-\\w]+[\\s]*$" /etc/audit/rules.d/audit.rules || echo "FAIL"; exit 1