From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7C22DC77B75 for ; Wed, 17 May 2023 23:17:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1684365475; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=ITVZi651vZmpRh8AEwsIqEMx0ydgPva0XCJRd0A7oAA=; b=a3OVAt0QizLcgGH9MlC9tCyDumf+blaI2EnLvL1chNbeQygHN7+Ud0WYVEuUo0DKrys59W BfuLCt3qA4xRKWlYm9XRxT9o1TtxLKjYD4/qIHkR1QgbtdAjLlwcpo9xMrOx4sTe6BIwiX FPuLV1mvw3MQ1LBgKyC32danPopDgNA= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-487-KLb7zllDNZmXqcvOOsbkYQ-1; Wed, 17 May 2023 19:17:53 -0400 X-MC-Unique: KLb7zllDNZmXqcvOOsbkYQ-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.rdu2.redhat.com [10.11.54.8]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 5889C3C0BE51; Wed, 17 May 2023 23:17:52 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 31019C15BA0; Wed, 17 May 2023 23:17:51 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id CD74919465A8; Wed, 17 May 2023 23:17:50 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id C170519465A4 for ; Wed, 17 May 2023 23:17:48 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 5A6FE2166B32; Wed, 17 May 2023 23:17:48 +0000 (UTC) Received: from x2.localnet (unknown [10.22.32.102]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 258082166B31; Wed, 17 May 2023 23:17:48 +0000 (UTC) From: Steve Grubb To: Claire Stafford Subject: Re: What STIG audit rule picks up type=SOFTWARE_UPDATE events? Date: Wed, 17 May 2023 19:17:47 -0400 Message-ID: <12288868.O9o76ZdvQC@x2> Organization: Red Hat In-Reply-To: <4d904cad-814b-c62c-0bb1-3d05630e7305@s4software.com> References: <7622dda18a1544c3bb52052019e34d72@jhuapl.edu> <5677897.DvuYhMxLoT@x2> <4d904cad-814b-c62c-0bb1-3d05630e7305@s4software.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.6 X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Linux-audit@redhat.com Errors-To: linux-audit-bounces@redhat.com Sender: "Linux-audit" X-Scanned-By: MIMEDefang 3.1 on 10.11.54.8 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGVsbG8sCgpPbiBXZWRuZXNkYXksIE1heSAxNywgMjAyMyAxOjU5OjQyIEFNIEVEVCBDbGFpcmUg U3RhZmZvcmQgd3JvdGU6Cj4gRm9yIHNvbWUgcmVhc29uIEkgaGFkIHRoZSBpZGVhIHRoYXQgdGhl cmUgd2VyZSBvdGhlciBzb2Z0d2FyZSByZWxhdGVkCj4gZXZlbnRzIC0gbm8gd29uZGVyIEkgY291 bGRuJ3QgZmluZCB0aGVtISAgUmVhbGx5IHRoZXkgb3VnaHQgdG8gYXQgbGVhc3QKPiBpbmRpY2F0 ZSBpZiB0aGUgaW5zdGFsbCBpcyBhIG5ldyBvciB1cGdyYWRlZCBwYWNrYWdlLCBhbHNvIHdoZW4g cGFja2FnZXMKPiBnZXQgZGVsZXRlZC4KCkl0IGRvZXMuIFRoZSAib3AiIGZpZWxkIHN1cHBvcnRz OiByZW1vdmUsIGluc3RhbGwsIHVwZGF0ZS4KCi1TdGV2ZQoKPiBPbiA1LzE2LzIzIDIxOjEyLCBT dGV2ZSBHcnViYiB3cm90ZToKPiA+IEhlbGxvLAo+ID4gCj4gPiBPbiBTdW5kYXksIE1heSAxNCwg MjAyMyA4OjI0OjQ3IFBNIEVEVCBDbGFpcmUgU3RhZmZvcmQgd3JvdGU6Cj4gPj4gVGhpcyBicmlu Z3MgdXAgdGhlIHF1ZXN0aW9uIG9mIHdoZXJlIEkgY2FuIGZpbmQgdGhlIGF1ZGl0IGV2ZW50cyB3 aGljaAo+ID4+IGFyZSBnZW5lcmF0ZWQgYnkgcnBtPwo+ID4gCj4gPiBhdXNlYXJjaCAtLXN0YXJ0 IHRvZGF5IC1tIFNPRlRXQVJFX1VQREFURQo+ID4gCj4gPj4gQWxzbyBkbmYveXVtIGlmIHRoZXkg ZGlyZWN0bHkgZ2VuZXJhdGUgZXZlbnRzPwo+ID4gCj4gPiBObywgdGhleSBhcmUgbGlua2VkIGFn YWluc3QgbGlicnBtLiBJdCBpbiB0dXJuIGhhcyBhIHBsdWdpbiwgcnBtLXBsdWdpbi0KPiA+IGF1 ZGl0LCB3aGljaCBnZW5lcmF0ZXMgdGhlIGF1ZGl0IGV2ZW50cy4KPiA+IAo+ID4+IEEgdmVyeSBx dWljayBzY2FuIG9mIHRoZSBycG0gc291cmNlIGNvZGUgZG9lc24ndCByZXZlYWwgYW55dGhpbmcu Cj4gPiAKPiA+IGh0dHBzOi8vZ2l0aHViLmNvbS9ycG0tc29mdHdhcmUtbWFuYWdlbWVudC9ycG0v YmxvYi9tYXN0ZXIvcGx1Z2lucy9hdWRpdC4KPiA+IGMKPiA+IAo+ID4gLVN0ZXZlCj4gPiAKPiA+ PiBPbiA1LzE0LzIzIDE0OjQ2LCBTdGV2ZW4gR3J1YmIgd3JvdGU6Cj4gPj4+IEhlbGxvLAo+ID4+ PiAKPiA+Pj4gCj4gPj4+IE9uIEZyaSwgTWF5IDEyLCAyMDIzIGF0IDU6MjPigK9QTSBXaWVwcmVj aHQsIEthcmVuIE0uCj4gPj4+IAo+ID4+PiA8S2FyZW4uV2llcHJlY2h0QGpodWFwbC5lZHU+ICB3 cm90ZToKPiA+Pj4gICAgICBBbGwsCj4gPj4+ICAgICAgCj4gPj4+ICAgICAgRG8geW91IGhhcHBl biB0byBrbm93IHdoaWNoIGlmIHRoZSBzdGFuZGFyZCBTVElHIHJ1bGVzIGlzIHBpY2tpbmcKPiA+ Pj4gICAgICB1cCAgIHR5cGU9U09GVFdBUkVfVVBEQVRFIGV2ZW50cyBvbiBSSEVMIDcgYW5kIDgg Pwo+ID4+PiAKPiA+Pj4gTm9uZS4gcnBtIGhhcyBiZWVuIGFsdGVyZWQgdG8gcHJvZHVjZSB0aGVz ZSBtdWNoIHRoZSBzYW1lIGFzIHBhbQo+ID4+PiBwcm9kdWNlcyBsb2dpbiBldmVudHMuIEl0IHdh cyB0b28gdHJpY2t5IHRvIHRlbGwgdGhlIGludGVudCB0byB1cGRhdGUKPiA+Pj4gdnMgcXVlcnlp bmcgdGhlIHJwbSBkYXRhYmFzZS4gQW5kIHlvdSBoYXZlIG5vIHdheSB0byBhbnN3ZXIgdGhlCj4g Pj4+IHF1ZXN0aW9uIGFib3V0IHN1Y2Nlc3Mgd2l0aG91dCBvcmlnaW5hdGluZyBmcm9tIGluc2lk ZSBycG0gaXRzZWxmLiBJCj4gPj4+IGRvbid0IHRoaW5rIGFueSBleHRlcm5hbCBydWxlcyBjYW4g bWVldCBhbGwgcmVxdWlyZW1lbnRzIGltcG9zZWQgYnkKPiA+Pj4gT1NQUCwgd2hpY2ggdGhlIFNU SUcgYXVkaXQgcnVsZXMgYXJlIGxvb3NlbHkgYmFzZWQgb24uCj4gPj4+IAo+ID4+PiAtU3RldmUK PiA+Pj4gCj4gPj4+ICAgICAgICBJ4oCZbSB0cnlpbmcgdG8gZmlndXJlIG91dCBpZiB3ZSBtaXNz ZWQgb25lIG9mIHRoZXNlIHJ1bGVzIG9uIGFuCj4gPj4+ICAgICAgCj4gPj4+ICAgICAgVWJ1bnR1 IDIwIHN5c3RlbSB3ZSBhcmUgY29uZmlndXJpbmcgIG9yIGlmIG1heWJlIHRoZSBhdWRpdAo+ID4+ PiAgICAgIHN1YnN5c3RlbSBpbXBsZW1lbnRhdGlvbiBvbiB0aGF0IHN5c3RlbSBkb2VzbuKAmXQg cGljayB1cCBhbGwgb2YgdGhlCj4gPj4+ICAgICAgc2FtZSByZWNvcmQgdHlwZXMgYXMgd2UgZ2V0 IG9uIG91ciBSSEVMIGJveGVzLiBJIHJlYWxpemVkIHdoZW4gSQo+ID4+PiAgICAgIHN0YXJ0ZWQg bG9va2luZyBhdCB0aGlzIHRoYXQgaXTigJlzIG5vdCBlYXN5IHRvIGRldGVybWluZSB3aGljaAo+ ID4+PiAgICAgIGF1ZGl0IHJ1bGUgaXMgcGlja2luZyB1cCBhIHBhcnRpY3VsYXIgZXZlbnQgaWYg aXTigJlzIG5vdCBvbmUgb2YgdGhlCj4gPj4+ICAgICAgcnVsZSB0aGF0IGhhcyBhIGtleSBhc3Nv Y2lhdGVkIHdpdGggaXQuCj4gPj4+ICAgICAgCj4gPj4+ICAgICAgQXMgYSBwb3NzaWJsZSBhbHRl cm5hdGl2ZSwgICBJIHJhbiBhY3Jvc3MgYSBzYW1wbGUgYXVkaXQucnVsZXMKPiA+Pj4gICAgICAK PiA+Pj4gICAgICAgbGlzdCBoZXJlIEdpdEh1YiAtIE5lbzIzeDAvYXVkaXRkOiBCZXN0IFByYWN0 aWNlIEF1ZGl0ZAo+ID4+PiAgICAgIAo+ID4+PiAgICAgIENvbmZpZ3VyYXRpb248aHR0cHM6Ly9n aXRodWIuY29tL05lbzIzeDAvYXVkaXRkPiAgIChhY3R1YWwgcnVsZXMKPiA+Pj4gICAgICBmaWxl IGlzIGhlcmU6IGF1ZGl0ZC9hdWRpdC5ydWxlcyBhdCBtYXN0ZXIgwrcgTmVvMjN4MC9hdWRpdGQg wrcKPiA+Pj4gICAgICBHaXRIdWIKPiA+Pj4gICAgICA8aHR0cHM6Ly9naXRodWIuY29tL05lbzIz eDAvYXVkaXRkL2Jsb2IvbWFzdGVyL2F1ZGl0LnJ1bGVzPikgd2hpY2gKPiA+Pj4gICAgICBpbmNs dWRlZCBzb21lIHNvZnR3YXJlIG1hbmFnZW1lbnQgcnVsZXMgdGhhdCBkb27igJl0IGFwcGVhciB0 byBiZQo+ID4+PiAgICAgIAo+ID4+PiAgICAgICBwYXJ0IG9mIHRoZSBzdGFuZGFyZCDigJwzMC1z dGlnLnJ1bGVz4oCdIC4KPiA+Pj4gICAgICAKPiA+Pj4gICAgICBJZiB0aGUgc3RhbmRhcmQgU1RJ RyBydWxlcyBkb27igJl0IHBpY2sgdXAgIHR5cGU9U09GVFdBUkVfVVBEQVRFCj4gPj4+ICAgICAg ZXZlbnRzIG9uIFVidW50dTIwLCAgSSBtaWdodCBhZGQgc29tZSBvZiB0aGVzZSAsIHNvIEkgd2Fz IGhvcGluZwo+ID4+PiAgICAgIHRvIGhhdmUgYSBxdWljayBzYW5pdHkgY2hlY2sgb24gd2hldGhl ciB0aGVzZSBsb29rIGxpa2UKPiA+Pj4gICAgICBhcHByb3ByaWF0ZSBhbHRlcm5hdGl2ZXMuICBB bnkgcmVjb21tZW5kYXRpb25zIG9yIGNvbW1lbnRzCj4gPj4+ICAgICAgcmVnYXJkaW5nIHRoZXNl IHNhbXBsZSBydWxlcyB3b3VsZCBiZSBtdWNoIGFwcHJlY2lhdGVkLiAgQmFzaWNhbGx5Cj4gPj4+ ICAgICAgaXQgbG9va3MgdG8gbWUgbGlrZSB0aGV5IGFyZSBqdXN0IHNldHRpbmcgd2F0Y2hlcyBm b3IgYW55b25lCj4gPj4+ICAgICAgCj4gPj4+ICAgICAgIGV4ZWN1dGluZyB0aGVzZSB2YXJpb3Vz IGNvbW1hbmRzLCB3aGljaCBzaG91bGRu4oCZdCBjYXVzZSB0byBtdWNoCj4gPj4+ICAgICAgCj4g Pj4+ICAgICAgbm9pc2UgaW4gdGhlIGxvZ3MgZXhjZXB0IG1heWJlIHdoZW4gd2UgYXJlIHBhdGNo aW5nIHdoaWNoIGlzIG9uZQo+ID4+PiAgICAgIG9mIHRoZSBjb250aW51b3VzIG1vbml0b3Jpbmcg aXRlbXMgSSAgbmVlZCB0byBiZSBhYmxlIHRvIGNvbmZpcm0uCj4gPj4+ICAgICAgCj4gPj4+ICAg ICAgVGhhbmtzIG11Y2ghCj4gPj4+ICAgICAgCj4gPj4+ICAgICAgS2FyZW4gV2llcHJlY2h0Cj4g Pj4+ICAgICAgCj4gPj4+ICAgICAgIyBTb2Z0d2FyZSBNYW5hZ2VtZW50Cj4gPj4+ICAgICAgLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCj4g Pj4+ICAgICAgCj4gPj4+ICAgICAgIyBSUE0gKFJlZGhhdC9DZW50T1MpCj4gPj4+ICAgICAgCj4g Pj4+ICAgICAgLXcgL3Vzci9iaW4vcnBtIC1wIHggLWsgc29mdHdhcmVfbWdtdAo+ID4+PiAgICAg IAo+ID4+PiAgICAgIC13IC91c3IvYmluL3l1bSAtcCB4IC1rIHNvZnR3YXJlX21nbXQKPiA+Pj4g ICAgICAKPiA+Pj4gICAgICAjIERORiAoRmVkb3JhL1JlZEhhdCA4L0NlbnRPUyA4KQo+ID4+PiAg ICAgIAo+ID4+PiAgICAgIC13IC91c3IvYmluL2RuZiAtcCB4IC1rIHNvZnR3YXJlX21nbXQKPiA+ Pj4gICAgICAKPiA+Pj4gICAgICAjIFlBU1QvWnlwcGVyL1JQTSAoU3VTRSkKPiA+Pj4gICAgICAK PiA+Pj4gICAgICAtdyAvc2Jpbi95YXN0IC1wIHggLWsgc29mdHdhcmVfbWdtdAo+ID4+PiAgICAg IAo+ID4+PiAgICAgIC13IC9zYmluL3lhc3QyIC1wIHggLWsgc29mdHdhcmVfbWdtdAo+ID4+PiAg ICAgIAo+ID4+PiAgICAgIC13IC9iaW4vcnBtIC1wIHggLWsgc29mdHdhcmVfbWdtdAo+ID4+PiAg ICAgIAo+ID4+PiAgICAgIC13IC91c3IvYmluL3p5cHBlciAtayBzb2Z0d2FyZV9tZ210Cj4gPj4+ ICAgICAgCj4gPj4+ICAgICAgIyBEUEtHIC8gQVBULUdFVCAoRGViaWFuL1VidW50dSkKPiA+Pj4g ICAgICAKPiA+Pj4gICAgICAtdyAvdXNyL2Jpbi9kcGtnIC1wIHggLWsgc29mdHdhcmVfbWdtdAo+ ID4+PiAgICAgIAo+ID4+PiAgICAgIC13IC91c3IvYmluL2FwdCAtcCB4IC1rIHNvZnR3YXJlX21n bXQKPiA+Pj4gICAgICAKPiA+Pj4gICAgICAtdyAvdXNyL2Jpbi9hcHQtYWRkLXJlcG9zaXRvcnkg LXAgeCAtayBzb2Z0d2FyZV9tZ210Cj4gPj4+ICAgICAgCj4gPj4+ICAgICAgLXcgL3Vzci9iaW4v YXB0LWdldCAtcCB4IC1rIHNvZnR3YXJlX21nbXQKPiA+Pj4gICAgICAKPiA+Pj4gICAgICAtdyAv dXNyL2Jpbi9hcHRpdHVkZSAtcCB4IC1rIHNvZnR3YXJlX21nbXQKPiA+Pj4gICAgICAKPiA+Pj4g ICAgICAtdyAvdXNyL2Jpbi93YWppZyAtcCB4IC1rIHNvZnR3YXJlX21nbXQKPiA+Pj4gICAgICAK PiA+Pj4gICAgICAtdyAvdXNyL2Jpbi9zbmFwIC1wIHggLWsgc29mdHdhcmVfbWdtdAo+ID4+PiAg ICAgIAo+ID4+PiAgICAgICMgUElQKDMpIChQeXRob24gaW5zdGFsbHMpCj4gPj4+ICAgICAgCj4g Pj4+ICAgICAgLXcgL3Vzci9iaW4vcGlwIC1wIHggLWsgVDEwNzJfdGhpcmRfcGFydHlfc29mdHdh cmUKPiA+Pj4gICAgICAKPiA+Pj4gICAgICAtdyAvdXNyL2xvY2FsL2Jpbi9waXAgLXAgeCAtayBU MTA3Ml90aGlyZF9wYXJ0eV9zb2Z0d2FyZQo+ID4+PiAgICAgIAo+ID4+PiAgICAgIC13IC91c3Iv YmluL3BpcDMgLXAgeCAtayBUMTA3Ml90aGlyZF9wYXJ0eV9zb2Z0d2FyZQo+ID4+PiAgICAgIAo+ ID4+PiAgICAgIC13IC91c3IvbG9jYWwvYmluL3BpcDMgLXAgeCAtayBUMTA3Ml90aGlyZF9wYXJ0 eV9zb2Z0d2FyZQo+ID4+PiAgICAgIAo+ID4+PiAgICAgICMgbnBtCj4gPj4+ICAgICAgCj4gPj4+ ICAgICAgIyMgVDEwNzIgdGhpcmQgcGFydHkgc29mdHdhcmUKPiA+Pj4gICAgICAKPiA+Pj4gICAg ICAjI2h0dHBzOi8vd3d3Lm5wbWpzLmNvbQo+ID4+PiAgICAgIAo+ID4+PiAgICAgICMjaHR0cHM6 Ly9kb2NzLm5wbWpzLmNvbS9jbGkvdjYvY29tbWFuZHMvbnBtLWF1ZGl0Cj4gPj4+ICAgICAgCj4g Pj4+ICAgICAgLXcgL3Vzci9iaW4vbnBtIC1wIHggLWsgVDEwNzJfdGhpcmRfcGFydHlfc29mdHdh cmUKPiA+Pj4gICAgICAKPiA+Pj4gICAgICAtLQo+ID4+PiAgICAgIExpbnV4LWF1ZGl0IG1haWxp bmcgbGlzdAo+ID4+PiAgICAgIExpbnV4LWF1ZGl0QHJlZGhhdC5jb20KPiA+Pj4gICAgICBodHRw czovL2xpc3RtYW4ucmVkaGF0LmNvbS9tYWlsbWFuL2xpc3RpbmZvL2xpbnV4LWF1ZGl0Cj4gPj4+ IAo+ID4+PiAtLQo+ID4+PiBMaW51eC1hdWRpdCBtYWlsaW5nIGxpc3QKPiA+Pj4gTGludXgtYXVk aXRAcmVkaGF0LmNvbQo+ID4+PiBodHRwczovL2xpc3RtYW4ucmVkaGF0LmNvbS9tYWlsbWFuL2xp c3RpbmZvL2xpbnV4LWF1ZGl0CgoKCgotLQpMaW51eC1hdWRpdCBtYWlsaW5nIGxpc3QKTGludXgt YXVkaXRAcmVkaGF0LmNvbQpodHRwczovL2xpc3RtYW4ucmVkaGF0LmNvbS9tYWlsbWFuL2xpc3Rp bmZvL2xpbnV4LWF1ZGl0Cg==