From 5d5ca0a3da8fa8e7f9a71569b5d3be99895410e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Tue, 16 Apr 2024 07:29:45 +0000 Subject: [PATCH] correct tests and instructions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- tests/1_host_configuration.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/1_host_configuration.sh b/tests/1_host_configuration.sh index 86247a8..4435b50 100644 --- a/tests/1_host_configuration.sh +++ b/tests/1_host_configuration.sh @@ -243,12 +243,12 @@ check_1_1_8() { local id="1.1.8" local desc="Ensure auditing is configured for Docker files and directories - containerd.sock (Automated)" local remediation - remediation="Install auditd. Add -w $(get_service_file containerd.socket) -k docker to the /etc/audit/rules.d/audit.rules file. Then restart the audit daemon using command service auditd restart." + remediation="Install auditd. Add -w $(get_service_file containerd.sock) -k docker to the /etc/audit/rules.d/audit.rules file. Then restart the audit daemon using command service auditd restart." local remediationImpact="Audit can generate large log files. So you need to make sure that they are rotated and archived periodically. Create a separate partition for audit logs to avoid filling up other critical partitions." local check="$id - $desc" starttestjson "$id" "$desc" - file="$(get_service_file containerd.socket)" + file="$(get_service_file containerd.sock)" if [ -e "$file" ]; then if command -v auditctl >/dev/null 2>&1; then if auditctl -l | grep "$file" >/dev/null 2>&1; then