{{% set rx_beg = "^[\s]*-a[\s]+always,exit[\s]+" %}} {{% set rx_b32 = "-F[\s]+arch=b32[\s]+" %}} {{% set rx_b64 = "-F[\s]+arch=b64[\s]+" %}} {{% if product == "ol8" %}} {{% set rx_uid = "-S[\s]+execve[\s]+-C[\s]+uid!=euid[\s]+" %}} {{% set rx_gid = "-S[\s]+execve[\s]+-C[\s]+gid!=egid[\s]+" %}} {{% else %}} {{% set rx_uid = "-S[\s]+execve[\s]+-C[\s]+uid!=euid[\s]+-F[\s]+euid=0[\s]+" %}} {{% set rx_gid = "-S[\s]+execve[\s]+-C[\s]+gid!=egid[\s]+-F[\s]+egid=0[\s]+" %}} {{% endif %}} {{% set rx_end = "(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$" %}} {{{ oval_metadata("Ensure audit rule for all uses of privileged functions is enabled") }}} ^/etc/audit/rules\.d/.*\.rules$ {{{ rx_beg + rx_b32 + rx_uid + rx_end }}} 1 ^/etc/audit/rules\.d/.*\.rules$ {{{ rx_beg + rx_b64 + rx_uid + rx_end }}} 1 /etc/audit/audit.rules {{{ rx_beg + rx_b32 + rx_uid + rx_end }}} 1 /etc/audit/audit.rules {{{ rx_beg + rx_b64 + rx_uid + rx_end }}} 1 ^/etc/audit/rules\.d/.*\.rules$ {{{ rx_beg + rx_b32 + rx_gid + rx_end }}} 1 ^/etc/audit/rules\.d/.*\.rules$ {{{ rx_beg + rx_b64 + rx_gid + rx_end }}} 1 /etc/audit/audit.rules {{{ rx_beg + rx_b32 + rx_gid + rx_end }}} 1 /etc/audit/audit.rules {{{ rx_beg + rx_b64 + rx_gid + rx_end }}} 1