What changed in Solaris 11 SPARC SCAP Benchmark V3R6V3R6 changes

Title

The operating system must generate audit records for the selected list of auditable events as defined in DoDW list of events.

Check text

OR AND OR - OS version is less than 11.4 uname_test (check: all, existence: all_exist) object uname_object: state uname_state: os_version pattern match "^11($|\\.[0-3]\\b)" - /etc/zones/index does not exist file_test (check: all, existence: none_exist) object file_object: filepath equals "/etc/zones/index" - /etc/zones/index contains global textfilecontent54_test (check: all, existence: at_least_one_exists) object textfilecontent54_object: filepath equals "/etc/zones/index"; pattern pattern match "^global:"; instance greater than or equal "1" OR - OS version is not less than 11.4 uname_test (check: all, existence: all_exist) object uname_object: state uname_state: os_version pattern match "^11($|\\.[0-3]\\b)" - /var/share/zones/index.json does not exist file_test (check: all, existence: none_exist) object file_object: filepath equals "/var/share/zones/index.json" - /var/share/zones/index.json does not contain 'path:/' textfilecontent54_test (check: all, existence: none_exist) object textfilecontent54_object: filepath equals "/var/share/zones/index.json"; pattern pattern match "\"path\":\\s+\"/\""; instance greater than or equal "1" - auditd is online smf_test (check: all, existence: all_exist) object smf_object: fmri equals "svc://localhost/system/auditd:default" state smf_state: service_state equals "ONLINE" The Audit Configuration profile is required. This check applies to the global zone only. Determine the zone that you are currently securing. # zonename If the command output is "global", this check applies. Check the status of the audit system. It must be auditing. # pfexec auditconfig -getcond If this command does not report: audit condition = auditing this is a finding.

V-216251 in V3R6