The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.
#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel7:def:626
# The Red Hat Enterprise Linux operating system must audit all uses of the unlink, unlinkat, rename, renameat, and rmdir syscalls.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
# audit augenrules
# textfilecontent54_object (textfilecontent54_test)
test_1() {
grep -Pq '^ExecStartPost=\-\/sbin\/augenrules.*$' '/usr/lib/systemd/system/auditd.service' &>/dev/null
}
# audit augenrules 32-bit unlink
# textfilecontent54_object (textfilecontent54_test)
test_2() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit rmdir
# textfilecontent54_object (textfilecontent54_test)
test_3() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit unlinkat
# textfilecontent54_object (textfilecontent54_test)
test_4() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit rename
# textfilecontent54_object (textfilecontent54_test)
test_5() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 32-bit renameat
# textfilecontent54_object (textfilecontent54_test)
test_6() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# Generic test for x86_64 architecture
# uname_object (uname_test)
test_7() {
(uname -p) | grep -qxF 'x86_64'
}
# Generic test for ppc64 architecture
# uname_object (uname_test)
test_8() {
(uname -p) | grep -qxF 'ppc64'
}
# Generic test for ppcle64 architecture
# uname_object (uname_test)
test_9() {
(uname -p) | grep -qxF 'ppc64le'
}
# audit augenrules 64-bit unlink
# textfilecontent54_object (textfilecontent54_test)
test_10() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit rmdir
# textfilecontent54_object (textfilecontent54_test)
test_11() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit unlinkat
# textfilecontent54_object (textfilecontent54_test)
test_12() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit rename
# textfilecontent54_object (textfilecontent54_test)
test_13() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit augenrules 64-bit renameat
# textfilecontent54_object (textfilecontent54_test)
test_14() {
grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit auditctl
# textfilecontent54_object (textfilecontent54_test)
test_15() {
grep -Pq '^ExecStartPost=\-\/sbin\/auditctl.*$' '/usr/lib/systemd/system/auditd.service' &>/dev/null
}
# audit auditctl 32-bit unlink
# textfilecontent54_object (textfilecontent54_test)
test_16() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit rmdir
# textfilecontent54_object (textfilecontent54_test)
test_17() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit unlinkat
# textfilecontent54_object (textfilecontent54_test)
test_18() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit rename
# textfilecontent54_object (textfilecontent54_test)
test_19() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 32-bit renameat
# textfilecontent54_object (textfilecontent54_test)
test_20() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# Generic test for x86_64 architecture
# uname_object (uname_test)
test_21() {
(uname -p) | grep -qxF 'x86_64'
}
# Generic test for ppc64 architecture
# uname_object (uname_test)
test_22() {
(uname -p) | grep -qxF 'ppc64'
}
# Generic test for ppcle64 architecture
# uname_object (uname_test)
test_23() {
(uname -p) | grep -qxF 'ppc64le'
}
# audit auditctl 64-bit unlink
# textfilecontent54_object (textfilecontent54_test)
test_24() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit rmdir
# textfilecontent54_object (textfilecontent54_test)
test_25() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit unlinkat
# textfilecontent54_object (textfilecontent54_test)
test_26() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit rename
# textfilecontent54_object (textfilecontent54_test)
test_27() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
# audit auditctl 64-bit renameat
# textfilecontent54_object (textfilecontent54_test)
test_28() {
grep -Pq '^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|-1|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}
if ( ( test_1 && test_2 && test_3 && test_4 && test_5 && test_6 && ( test_7 || test_8 || test_9 || test_10 || test_11 || test_12 || test_13 || test_14 ) ) || ( test_15 && test_16 && test_17 && test_18 && test_19 && test_20 && ( test_21 || test_22 || test_23 || test_24 || test_25 || test_26 || test_27 || test_28 ) ) ); then
echo "PASS"
else
echo "FAIL"
fi Assessment Script Powered by AISandbox-executed
A standalone Shell script to assess this control automatically. Review before running it in your environment.
Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.
#!/bin/sh
# oval:mil.disa.stig.rhel7:def:626 compliance check
if [ ! -f "/usr/lib/systemd/system/auditd.service" ]; then echo "PASS"; exit 0; fi
if grep -q "ExecStartPost=-/sbin/augenrules" /usr/lib/systemd/system/auditd.service && \
grep -q "-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat,rmdir -F auid>=1000 -F auid != unset -k delete" /etc/audit/rules.d/*.rules && \
grep -q "-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat,rmdir -F auid>=1000 -F auid != unset -k delete" /etc/audit/rules.d/*.rules ]; then echo "PASS"; exit 0; else echo "FAIL"; exit 1; fi