From mboxrd@z Thu Jan 1 00:00:00 1970 From: leam hall Subject: Removing open_by_handle_at in local copy of stig.rules Date: Mon, 4 Nov 2013 08:55:16 -0500 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1382129288596379687==" Return-path: Received: from mx1.redhat.com (ext-mx16.extmail.prod.ext.phx2.redhat.com [10.5.110.21]) by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id rA4DtHsP025276 for ; Mon, 4 Nov 2013 08:55:17 -0500 Received: from mail-pb0-f42.google.com (mail-pb0-f42.google.com [209.85.160.42]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id rA4DtGSn020111 for ; Mon, 4 Nov 2013 08:55:16 -0500 Received: by mail-pb0-f42.google.com with SMTP id jt11so7182325pbb.1 for ; Mon, 04 Nov 2013 05:55:16 -0800 (PST) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============1382129288596379687== Content-Type: multipart/alternative; boundary=047d7b86ec5e0ce29804ea5a4461 --047d7b86ec5e0ce29804ea5a4461 Content-Type: text/plain; charset=UTF-8 As much as I'd like to be on a more current kernel, the open_by_handle_at syscall seems to have been introduced in 2.6.39, per para 1.9 of: http://kernelnewbies.org/Linux_2_6_39 I removed it from my local copy of: https://fedorahosted.org/audit/browser/trunk/contrib/stig.rules My old RHEL 5 boxes are easily confused with this new-fangled stuff! :) Is there a plan to have a RHEL 5 and RHEL 6 version of the stig.rules? Leam -- Mind on a Mission --047d7b86ec5e0ce29804ea5a4461 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
As much as I'd like to be on a more cur= rent kernel, the open_by_handle_at syscall seems to have been introduced in= 2.6.39, per para 1.9 of:

http://kernelnewbies.org/Linux_2_6_39

I removed it from my local copy of:

https://fedorahosted.org/au= dit/browser/trunk/contrib/stig.rules

My old RHEL 5 b= oxes are easily confused with this new-fangled stuff!=C2=A0 :)

Is there a plan to have a RHEL 5 and RHEL 6 version of the s= tig.rules?

Leam
--047d7b86ec5e0ce29804ea5a4461-- --===============1382129288596379687== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1382129288596379687==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Removing open_by_handle_at in local copy of stig.rules Date: Mon, 04 Nov 2013 09:05:25 -0500 Message-ID: <10647767.5C2iiaqxFi@x2> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Monday, November 04, 2013 08:55:16 AM leam hall wrote: > As much as I'd like to be on a more current kernel, the open_by_handle_at > syscall seems to have been introduced in 2.6.39, per para 1.9 of: > > http://kernelnewbies.org/Linux_2_6_39 > > I removed it from my local copy of: > > https://fedorahosted.org/audit/browser/trunk/contrib/stig.rules > > My old RHEL 5 boxes are easily confused with this new-fangled stuff! :) You would have to have an auditctl that matched it. > Is there a plan to have a RHEL 5 and RHEL 6 version of the stig.rules? I think they are pretty well separated. The rules shipped in rhel5 I think are current with the requirements levied on RHEL5. RHEL6 just got a STIG and I have not yet reviewed it to see if they stuck to the agreement we had. But the rules that would apply to RHEL6 would be shipped on RHEL6. I had not planned to separate them in svn. -Steve