<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title></title>
</head>
<body>
<div name="messageBodySection" style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;">Got it.</div>
<div name="messageSignatureSection" style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;"><br />
Thanks,<br />
<br />
<br />
Josh</div>
<div name="messageReplySection" style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;"><br />
On Apr 3, 2017, 5:56 AM -0400, Jan Lieskovsky <jlieskov@redhat.com>, wrote:<br />
<blockquote type="cite" style="margin: 5px 5px; padding-left: 10px; border-left: thin solid #1abc9c;">Hello Josh,<br />
<br />
<blockquote type="cite" style="margin: 5px 5px; padding-left: 10px; border-left: thin solid #e67e22;"><br />
Hi I am using oscap on centos 7.1 to run a PCI profile check. The system is<br />
64 bit (see arch and uname -a). However, when I run the remediation I get<br />
some 32 bit runs (see /etc/audit/rules.d/audit_time_rules.rules). Can<br />
anybody explain why this would be? Or is it a bug?<br /></blockquote>
<br />
On 64-bit system you want to track both 32-bit and 64-bit system calls via<br />
audit (since also 32-bit applications can do something wrong there...).<br />
<br />
<blockquote type="cite" style="margin: 5px 5px; padding-left: 10px; border-left: thin solid #e67e22;"><br />
<br />
COMMAND<br />
oscap xccdf eval --remediate --tailoring-file tailoring.xml --report<br />
report.html --profile xccdf_org.ssgproject.content_profile_pci-dss_with_ot<br />
/usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml<br />
<br />
CONFIRM 64BIT<br />
[root@test ~]# arch<br />
x86_64<br />
[root@test ~]# uname -a<br />
Linux test.checkoutstagingapp.com 3.10.0-229.el7.x86_64 #1 SMP Fri Mar 6<br />
11:36:42 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux<br />
<br />
32 BIT REMEDIATION RULE<br />
[root@test ~]# cat /etc/audit/rules.d/audit_time_rules.rules<br />
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k<br />
audit_time_rules<br />
-w /etc/localtime -p wa -k audit_time_rules<br /></blockquote>
<br />
This is expected / OK under assumption there's also corresponding<br />
entry for 64-bit system -- something like:<br />
<br />
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k audit_time_rules<br />
<br />
The "stime" call doesn't have 64-bit equivalent:<br />
$ ausyscall x86_64 stime<br />
Unknown syscall stime using x86_64 lookup table<br />
<br />
$ ausyscall i686 stime<br />
stime 25<br />
<br />
that's why it wouldn't be present in the 64-bit equivalent (but the rest<br />
of the rule except arch would be same).<br />
<br />
<blockquote type="cite" style="margin: 5px 5px; padding-left: 10px; border-left: thin solid #e67e22;">Thanks,<br />
<br />
<br />
Josh Moore<br />
Chief Architect<br />
TarokoSoftware<br />
<br /></blockquote>
<br />
HTH.<br />
<br />
Regards, Jan<br /></blockquote>
</div>
</body>
</html>