inspec/test/unit/mock/cmd/auditctl

-a always,exit -F arch=b64 -S open,openat -F exit=-EACCES -F key=access
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=500 f24!=0 -F key=perm_mod
-w /etc/ssh/sshd_config -p rwxa -k CFG_sshd_config
-w /etc/sudoers -p wa
-w /etc/private-keys -p x
auditd_rules: unit tests, meet the real world 2016-01-29 11:13:52 +01:00			`-a always,exit -F arch=b64 -S open,openat -F exit=-EACCES -F key=access`
			`-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=500 f24!=0 -F key=perm_mod`
auditd_rules: teach old dog new tricks 2016-01-28 17:08:41 +01:00			`-w /etc/ssh/sshd_config -p rwxa -k CFG_sshd_config`
auditd_rules resource: fix get_keys error on lines that have no keys (#2103) * Added line to fix bug when no key in file rule and updated test to validate bug fix Signed-off-by: Jennifer Burns <jburns@mitre.org> * Updated to consider corner case Signed-off-by: Jennifer Burns <jburns@mitre.org> 2017-08-29 01:11:14 -04:00			`-w /etc/sudoers -p wa`
			`-w /etc/private-keys -p x`