The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.
#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel7:def:805
# The Red Hat Enterprise Linux operating system must audit all uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate syscalls.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
# audit augenrules
# textfilecontent54_object (textfilecontent54_test)
test_1() {
grep -Pq '^ExecStartPost=\-\/sbin\/augenrules.*$' '/usr/lib/systemd/system/auditd.service' &>/dev/null
}
# audit augenrules 32-bit file eaccess for open
# textfilecontent54_object (textfilecontent54_test)
test_2() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit file eperm for open
# textfilecontent54_object (textfilecontent54_test)
test_3() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit file eaccess for creat
# textfilecontent54_object (textfilecontent54_test)
test_4() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit file eperm for creat
# textfilecontent54_object (textfilecontent54_test)
test_5() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit file eaccess for ftruncate
# textfilecontent54_object (textfilecontent54_test)
test_6() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit file eperm for ftruncate
# textfilecontent54_object (textfilecontent54_test)
test_7() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit file eaccess for openat
# textfilecontent54_object (textfilecontent54_test)
test_8() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit file eperm for openat
# textfilecontent54_object (textfilecontent54_test)
test_9() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit file eaccess for open_by_handle_at
# textfilecontent54_object (textfilecontent54_test)
test_10() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit file eperm for open_by_handle_at
# textfilecontent54_object (textfilecontent54_test)
test_11() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit file eaccess for truncate
# textfilecontent54_object (textfilecontent54_test)
test_12() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit file eperm for truncate
# textfilecontent54_object (textfilecontent54_test)
test_13() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# Generic test for x86_64 architecture
# uname_object (uname_test)
test_14() {
(uname -p) | grep -qxF 'x86_64'
}
# Generic test for ppc64 architecture
# uname_object (uname_test)
test_15() {
(uname -p) | grep -qxF 'ppc64'
}
# Generic test for ppcle64 architecture
# uname_object (uname_test)
test_16() {
(uname -p) | grep -qxF 'ppc64le'
}
# audit augenrules 64-bit file eaccess for open
# textfilecontent54_object (textfilecontent54_test)
test_17() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit file eperm for open
# textfilecontent54_object (textfilecontent54_test)
test_18() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit file eaccess for creat
# textfilecontent54_object (textfilecontent54_test)
test_19() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit file epermfor creat
# textfilecontent54_object (textfilecontent54_test)
test_20() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit file eaccess for ftruncate
# textfilecontent54_object (textfilecontent54_test)
test_21() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit file eperm for ftruncate
# textfilecontent54_object (textfilecontent54_test)
test_22() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit file eaccess for openat
# textfilecontent54_object (textfilecontent54_test)
test_23() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit file eperm for openat
# textfilecontent54_object (textfilecontent54_test)
test_24() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit file eaccess for open_by_handle_at
# textfilecontent54_object (textfilecontent54_test)
test_25() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit file eperm for open_by_handle_at
# textfilecontent54_object (textfilecontent54_test)
test_26() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit file eaccess for truncate
# textfilecontent54_object (textfilecontent54_test)
test_27() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit file eperm for truncate
# textfilecontent54_object (textfilecontent54_test)
test_28() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit auditctl
# textfilecontent54_object (textfilecontent54_test)
test_29() {
grep -Pq '^ExecStartPost=\-\/sbin\/auditctl.*$' '/usr/lib/systemd/system/auditd.service' &>/dev/null
}
# audit auditctl 32-bit file eaccess for open
# textfilecontent54_object (textfilecontent54_test)
test_30() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit file eperm for open
# textfilecontent54_object (textfilecontent54_test)
test_31() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit file eaccess for creat
# textfilecontent54_object (textfilecontent54_test)
test_32() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit file eperm for creat
# textfilecontent54_object (textfilecontent54_test)
test_33() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit file eaccess for ftruncate
# textfilecontent54_object (textfilecontent54_test)
test_34() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit file eperm for ftruncate
# textfilecontent54_object (textfilecontent54_test)
test_35() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit file eaccess for openat
# textfilecontent54_object (textfilecontent54_test)
test_36() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit file eperm for openat
# textfilecontent54_object (textfilecontent54_test)
test_37() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit file eaccess for open_by_handle_at
# textfilecontent54_object (textfilecontent54_test)
test_38() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit file eperm for open_by_handle_at
# textfilecontent54_object (textfilecontent54_test)
test_39() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit file eaccess for truncate
# textfilecontent54_object (textfilecontent54_test)
test_40() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit file eperm for truncate
# textfilecontent54_object (textfilecontent54_test)
test_41() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# Generic test for x86_64 architecture
# uname_object (uname_test)
test_42() {
(uname -p) | grep -qxF 'x86_64'
}
# Generic test for ppc64 architecture
# uname_object (uname_test)
test_43() {
(uname -p) | grep -qxF 'ppc64'
}
# Generic test for ppcle64 architecture
# uname_object (uname_test)
test_44() {
(uname -p) | grep -qxF 'ppc64le'
}
# audit auditctl 64-bit file eaccess for open
# textfilecontent54_object (textfilecontent54_test)
test_45() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit file eperm for open
# textfilecontent54_object (textfilecontent54_test)
test_46() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit file eaccess for creat
# textfilecontent54_object (textfilecontent54_test)
test_47() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit file eperm for creat
# textfilecontent54_object (textfilecontent54_test)
test_48() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit file eaccess for ftruncate
# textfilecontent54_object (textfilecontent54_test)
test_49() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit file eperm for ftruncate
# textfilecontent54_object (textfilecontent54_test)
test_50() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit file eaccess for openat
# textfilecontent54_object (textfilecontent54_test)
test_51() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit file eperm for openat
# textfilecontent54_object (textfilecontent54_test)
test_52() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit file eaccess for open_by_handle_at
# textfilecontent54_object (textfilecontent54_test)
test_53() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit file eperm for open_by_handle_at
# textfilecontent54_object (textfilecontent54_test)
test_54() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit file eaccess for truncate
# textfilecontent54_object (textfilecontent54_test)
test_55() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:.*-F\s+exit=\-EACCES[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit file eperm for truncate
# textfilecontent54_object (textfilecontent54_test)
test_56() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:.*-F\s+exit=\-EPERM[\s]+)(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
if ( ( test_1 && test_2 && test_3 && test_4 && test_5 && test_6 && test_7 && test_8 && test_9 && test_10 && test_11 && test_12 && test_13 && ( test_14 || test_15 || test_16 || ( test_17 && test_18 && test_19 && test_20 && test_21 && test_22 && test_23 && test_24 && test_25 && test_26 && test_27 && test_28 ) ) ) || ( test_29 && test_30 && test_31 && test_32 && test_33 && test_34 && test_35 && test_36 && test_37 && test_38 && test_39 && test_40 && test_41 && ( test_42 || test_43 || test_44 || ( test_45 && test_46 && test_47 && test_48 && test_49 && test_50 && test_51 && test_52 && test_53 && test_54 && test_55 && test_56 ) ) ) ); then
echo "PASS"
else
echo "FAIL"
fi