<Group id="auditing">
<title>System Accounting with <tt>auditd</tt></title>
<description>The audit service provides substantial capabilities
for recording system activities. By default, the service audits about
SELinux AVC denials and certain types of security-relevant events
such as system logins, account modifications, and authentication
events performed by programs such as sudo.
Under its default configuration, <tt>auditd</tt> has modest disk space
requirements, and should not noticeably impact system performance.
<br />
NOTE: The Linux Audit daemon <tt>auditd</tt> can be configured to use
the <tt>augenrules</tt> program to read audit rules files (<tt>*.rules</tt>)
located in <tt>/etc/audit/rules.d</tt> location and compile them to create
the resulting form of the <tt>/etc/audit/audit.rules</tt> configuration file
during the daemon startup (default configuration). Alternatively, the <tt>auditd</tt>
daemon can use the <tt>auditctl</tt> utility to read audit rules from the
<tt>/etc/audit/audit.rules</tt> configuration file during daemon startup,
and load them into the kernel. The expected behavior is configured via the
appropriate <tt>ExecStartPost</tt> directive setting in the
<tt>/usr/lib/systemd/system/auditd.service</tt> configuration file.
To instruct the <tt>auditd</tt> daemon to use the <tt>augenrules</tt> program
to read audit rules (default configuration), use the following setting:
<br /> <pre>ExecStartPost=-/sbin/augenrules --load</pre>
in the <tt>/usr/lib/systemd/system/auditd.service</tt> configuration file.
In order to instruct the <tt>auditd</tt> daemon to use the <tt>auditctl</tt>
utility to read audit rules, use the following setting:
<br /> <pre>ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules</pre>
in the <tt>/usr/lib/systemd/system/auditd.service</tt> configuration file.
Refer to <tt>[Service]</tt> section of the <tt>/usr/lib/systemd/system/auditd.service</tt>
configuration file for further details.
<br />
Government networks often have substantial auditing
requirements and <tt>auditd</tt> can be configured to meet these
requirements.
Examining some example audit records demonstrates how the Linux audit system
satisfies common requirements.
The following example from Fedora Documentation available at
<tt>https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/SELinux_Users_and_Administrators_Guide/sect-Security-Enhanced_Linux-Troubleshooting-Fixing_Problems.html#sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages</tt>
shows the substantial amount of information captured in a
two typical "raw" audit messages, followed by a breakdown of the most important
fields. In this example the message is SELinux-related and reports an AVC
denial (and the associated system call) that occurred when the Apache HTTP
Server attempted to access the <tt>/var/www/html/file1</tt> file (labeled with
the <tt>samba_share_t</tt> type):
<pre>type=AVC msg=audit(1226874073.147:96): avc:  denied  { getattr } for pid=2465 comm="httpd"
path="/var/www/html/file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0
tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file

type=SYSCALL msg=audit(1226874073.147:96): arch=40000003 syscall=196 success=no exit=-13
a0=b98df198 a1=bfec85dc a2=54dff4 a3=2008171 items=0 ppid=2463 pid=2465 auid=502 uid=48
gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=6 comm="httpd"
exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
</pre>
<ul>
<li><tt>msg=audit(1226874073.147:96)</tt>
<ul><li>The number in parentheses is the unformatted time stamp (Epoch time)
for the event, which can be converted to standard time by using the
<tt>date</tt> command.
</li></ul>
</li>
<li><tt>{ getattr }</tt>
<ul><li>The item in braces indicates the permission that was denied. <tt>getattr</tt>
indicates the source process was trying to read the target file's status information.
This occurs before reading files. This action is denied due to the file being
accessed having the wrong label. Commonly seen permissions include <tt>getattr</tt>,
<tt>read</tt>, and <tt>write</tt>.</li></ul>
</li>
<li><tt>comm="httpd"</tt>
<ul><li>The executable that launched the process. The full path of the executable is
found in the <tt>exe=</tt> section of the system call (<tt>SYSCALL</tt>) message,
which in this case, is <tt>exe="/usr/sbin/httpd"</tt>.
</li></ul>
</li>
<li><tt>path="/var/www/html/file1"</tt>
<ul><li>The path to the object (target) the process attempted to access.
</li></ul>
</li>
<li><tt>scontext="unconfined_u:system_r:httpd_t:s0"</tt>
<ul><li>The SELinux context of the process that attempted the denied action. In
this case, it is the SELinux context of the Apache HTTP Server, which is running
in the <tt>httpd_t</tt> domain.
</li></ul>
</li>
<li><tt>tcontext="unconfined_u:object_r:samba_share_t:s0"</tt>
<ul><li>The SELinux context of the object (target) the process attempted to access.
In this case, it is the SELinux context of <tt>file1</tt>. Note: the <tt>samba_share_t</tt>
type is not accessible to processes running in the <tt>httpd_t</tt> domain.</li>
</ul>
</li>
<li> From the system call (<tt>SYSCALL</tt>) message, two items are of interest:
<ul><li><tt>success=no</tt>: indicates whether the denial (AVC) was enforced or not.
<tt>success=no</tt> indicates the system call was not successful (SELinux denied
access). <tt>success=yes</tt> indicates the system call was successful - this can
be seen for permissive domains or unconfined domains, such as <tt>initrc_t</tt>
and <tt>kernel_t</tt>.
</li>
<li><tt>exe="/usr/sbin/httpd"</tt>: the full path to the executable that launched
the process, which in this case, is <tt>exe="/usr/sbin/httpd"</tt>.
</li></ul>
</li></ul>
</description>

<Rule id="service_auditd_enabled" severity="medium">
<title>Enable auditd Service</title>
<description>The <tt>auditd</tt> service is an essential userspace component of
the Linux Auditing System, as it is responsible for writing audit records to
disk.
<service-enable-macro service="auditd" />
</description>
<ocil><service-enable-check-macro service="auditd" /></ocil>
<rationale>Ensuring the <tt>auditd</tt> service is active ensures
audit records generated by the kernel can be written to disk, or that appropriate
actions will be taken if other obstacles exist.
</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="service_auditd_enabled" />
<ref nist="AC-17(1),AU-1(b),AU-10,AU-12(a),AU-12(c),IR-5" disa="347,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" />
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="bootloader_audit_argument" severity="medium">
<title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</title>
<description>To ensure all processes can be audited, even those which start
prior to the audit daemon, add the argument <tt>audit=1</tt> to the default
GRUB 2 command line for the Linux operating system in
<tt>/etc/default/grub</tt>, in the manner below:
<pre>GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=VolGroup/LogVol06 rd.lvm.lv=VolGroup/lv_swap rhgb quiet rd.shell=0 audit=1"</pre>
</description>
<ocil clause="auditing is not enabled at boot time">
Inspect the form of default GRUB 2 command line for the Linux operating system
in <tt>/etc/default/grub</tt>. If they include <tt>audit=1</tt>, then auditing
is enabled at boot time.
</ocil>
<rationale>
Each process on the system carries an "auditable" flag which indicates whether
its activities can be audited. Although <tt>auditd</tt> takes care of enabling
this for all processes which launch after it does, adding the kernel argument
ensures it is set for every process during boot.
</rationale>
<warning category="general">The GRUB 2 configuration file, <tt>grub.cfg</tt>,
is automatically updated each time a new kernel is installed. Note that any
changes to <tt>/etc/default/grub</tt> require rebuilding the <tt>grub.cfg</tt>
file. To update the GRUB 2 configuration file manually, use the
<pre>grub2-mkconfig -o</pre> command as follows:
<ul>
<li>On BIOS-based machines, issue the following command as <tt>root</tt>:
<pre>~]# grub2-mkconfig -o /boot/grub2/grub.cfg</pre></li>
<li>On UEFI-based machines, issue the following command as <tt>root</tt>:
<pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li>
</ul>
</warning>
<ident cce="RHEL7-CCE-TBD" />
<oval id="bootloader_audit_argument" />
<ref nist="AC-17(1),AU-14(1),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-10,IR-5" disa="1464,130" />
</Rule>

<Group id="configure_auditd_data_retention">
<title>Configure <tt>auditd</tt> Data Retention</title>
<description>
The audit system writes data to <tt>/var/log/audit/audit.log</tt>. By default,
<tt>auditd</tt> rotates 5 logs by size (6MB), retaining a maximum of 30MB of
data in total, and refuses to write entries when the disk is too
full. This minimizes the risk of audit data filling its partition
and impacting other services. This also minimizes the risk of the audit
daemon temporarily disabling the system if it cannot write audit log (which
it can be configured to do).

For a busy
system or a system which is thoroughly auditing system activity, the default settings
for data retention may be
 insufficient. The log file size needed will depend heavily on what types
of events are being audited. First configure auditing to log all the events of
interest. Then monitor the log size manually for awhile to determine what file
size will allow you to keep the required data for the correct time period.
<br/><br/>
Using a dedicated partition for <tt>/var/log/audit</tt> prevents the
<tt>auditd</tt> logs from disrupting system functionality if they fill, and,
more importantly, prevents other activity in <tt>/var</tt> from filling the
partition and stopping the audit trail. (The audit logs are size-limited and
therefore unlikely to grow without bound unless configured to do so.) Some
machines may have requirements that no actions occur which cannot be audited.
If this is the case, then <tt>auditd</tt> can be configured to halt the machine
if it runs out of space. <b>Note:</b> Since older logs are rotated,
configuring <tt>auditd</tt> this way does not prevent older logs from being
rotated away before they can be viewed.

<i>If your system is configured to halt when logging cannot be performed, make
sure this can never happen under normal circumstances! Ensure that
<tt>/var/log/audit</tt> is on its own partition, and that this partition is
larger than the maximum amount of data <tt>auditd</tt> will retain
normally.</i>
</description>
<ref nist="AU-11" disa="138" />

<Value id="var_auditd_num_logs" type="number" >
<title>Number of log files for auditd to retain</title>
<description>The setting for num_logs in /etc/audit/auditd.conf</description>
<value selector="">5</value>
<value selector="5">5</value>
<value selector="4">4</value>
<value selector="3">3</value>
<value selector="2">2</value>
<value selector="1">1</value>
<value selector="0">0</value>
</Value>

<Value id="var_auditd_max_log_file" type="number" >
<title>Maximum audit log file size for auditd</title>
<description>The setting for max_log_size in /etc/audit/auditd.conf</description>
<value selector="">6</value>
<value selector="20">20</value>
<value selector="10">10</value>
<value selector="6">6</value>
<value selector="5">5</value>
<value selector="1">1</value>
</Value>

<Value id="var_auditd_max_log_file_action" type="string" >
<title>Action for auditd to take when log files reach their maximum size</title>
<description>The setting for max_log_file_action in /etc/audit/auditd.conf</description>
<value selector="">rotate</value>
<value selector="ignore">ignore</value>
<value selector="syslog">syslog</value>
<value selector="suspend">suspend</value>
<value selector="rotate">rotate</value>
<value selector="keep_logs">keep_logs</value>
</Value>

<Value id="var_auditd_space_left_action" type="string" >
<title>Action for auditd to take when disk space just starts to run low</title>
<description>The setting for space_left_action in /etc/audit/auditd.conf</description>
<value selector="">email</value>
<value selector="ignore">ignore</value>
<value selector="syslog">syslog</value>
<value selector="email">email</value>
<value selector="exec">exec</value>
<value selector="suspend">suspend</value>
<value selector="single">single</value>
<value selector="halt">halt</value>
</Value>

<Value id="var_auditd_admin_space_left_action" type="string" >
<title>Action for auditd to take when disk space just starts to run low</title>
<description>The setting for space_left_action in /etc/audit/auditd.conf</description>
<value selector="">single</value>
<value selector="ignore">ignore</value>
<value selector="syslog">syslog</value>
<value selector="email">email</value>
<value selector="exec">exec</value>
<value selector="suspend">suspend</value>
<value selector="single">single</value>
<value selector="halt">halt</value>
</Value>

<Value id="var_auditd_action_mail_acct" type="string" >
<title>Account for auditd to send email when actions occurs</title>
<description>The setting for action_mail_acct in /etc/audit/auditd.conf</description>
<value selector="">root</value>
<value selector="root">root</value>
<value selector="admin">admin</value>
</Value>

<Value id="var_auditd_flush" type="string" >
<title>Auditd priority for flushing data to disk</title>
<description>The setting for flush in /etc/audit/auditd.conf</description>
<value selector="">data</value>
<value selector="none">none</value>
<value selector="incremental">incremental</value>
<value selector="data">data</value>
<value selector="sync">sync</value>
</Value>

<Rule id="auditd_data_retention_num_logs" severity="medium">
<title>Configure auditd Number of Logs Retained</title>
<description>Determine how many log files
<tt>auditd</tt> should retain when it rotates logs.
Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following
line, substituting <i>NUMLOGS</i> with the correct value of <sub idref="var_auditd_num_logs" />:
<pre>num_logs = <i>NUMLOGS</i></pre>
Set the value to 5 for general-purpose systems. 
Note that values less than 2 result in no log rotation.</description>
<ocil clause="the system log file retention has not been properly configured">
Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
determine how many logs the system is configured to retain after rotation:
<tt>$ sudo grep num_logs /etc/audit/auditd.conf</tt>
<pre>num_logs = 5</pre>
</ocil>
<rationale>The total storage for audit log files must be large enough to retain
log information over the period required. This is a function of the maximum log
file size and the number of logs retained.</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="auditd_data_retention_num_logs" value="var_auditd_num_logs" />
<ref nist="AU-1(b),AU-11,IR-5" />
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="auditd_data_retention_max_log_file" severity="medium">
<title>Configure auditd Max Log File Size</title>
<description>Determine the amount of audit data (in megabytes)
which should be retained in each log file. Edit the file
<tt>/etc/audit/auditd.conf</tt>. Add or modify the following line, substituting
the correct value of <sub idref="var_auditd_max_log_file" /> for <i>STOREMB</i>:
<pre>max_log_file = <i>STOREMB</i></pre>
Set the value to <tt>6</tt> (MB) or higher for general-purpose systems.
Larger values, of course,
support retention of even more audit data.</description>
<ocil clause="the system audit data threshold has not been properly configured">
Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
determine how much data the system will retain in each audit log file:
<tt>$ sudo grep max_log_file /etc/audit/auditd.conf</tt>
<pre>max_log_file = 6</pre>
</ocil>
<rationale>The total storage for audit log files must be large enough to retain
log information over the period required. This is a function of the maximum
log file size and the number of logs retained.</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="auditd_data_retention_max_log_file" value="var_auditd_max_log_file" />
<ref nist="AU-1(b),AU-11,IR-5" />
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="auditd_data_retention_max_log_file_action" severity="medium">
<title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</title>
<description> The default action to take when the logs reach their maximum size
is to rotate the log files, discarding the oldest one. To configure the action taken
by <tt>auditd</tt>, add or correct the line in <tt>/etc/audit/auditd.conf</tt>:
<pre>max_log_file_action = <i>ACTION</i></pre>
Possible values for <i>ACTION</i> are described in the <tt>auditd.conf</tt> man
page. These include:
<ul>
<li><tt>ignore</tt></li>
<li><tt>syslog</tt></li>
<li><tt>suspend</tt></li>
<li><tt>rotate</tt></li>
<li><tt>keep_logs</tt></li>
</ul>
Set the <tt><i>ACTION</i></tt> to <tt>rotate</tt> to ensure log rotation
occurs.  This is the default.  The setting is case-insensitive.
</description>
<ocil clause="the system has not been properly configured to rotate audit logs">
Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
determine if the system is configured to rotate logs when they reach their
maximum size:
<tt>$ sudo grep max_log_file_action /etc/audit/auditd.conf</tt>
<pre>max_log_file_action <tt>rotate</tt></pre>
</ocil>
<rationale>Automatically rotating logs (by setting this to <tt>rotate</tt>)
minimizes the chances of the system unexpectedly running out of disk space by
being overwhelmed with log data. However, for systems that must never discard
log data, or which use external processes to transfer it and reclaim space,
<tt>keep_logs</tt> can be employed.</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="auditd_data_retention_max_log_file_action" value="var_auditd_max_log_file_action" />
<ref nist="AU-1(b),AU-4,AU-11,IR-5" />
<tested by="DS" on="20121024"/>
</Rule>

<!--
<Group id="auditd_logical_volume">
<title>Configure auditd to Use a Separate Partition or Logical Volume</title>
<description>Use a dedicated partition (or logical volume) for log files. It is
straightforward to create such a partition or logical volume during system
installation time. The partition should be larger than the maximum space which
<tt>auditd</tt> will ever use, which is the maximum size of each log file
(<tt>max_log_file</tt>) multiplied by the number of log files
(<tt>num_logs</tt>). Ensure the partition is mounted on
<tt>/var/log/audit</tt>.
</description>
</Group>
-->

<Rule id="auditd_data_retention_space_left_action" severity="medium">
<title>Configure auditd space_left Action on Low Disk Space</title>
<description>The <tt>auditd</tt> service can be configured to take an action
when disk space <i>starts</i> to run low.
Edit the file <tt>/etc/audit/auditd.conf</tt>. Modify the following line,
substituting <i>ACTION</i> appropriately:
<pre>space_left_action = <i>ACTION</i></pre>
Possible values for <i>ACTION</i> are described in the <tt>auditd.conf</tt> man page.
These include:
<ul>
<li><tt>ignore</tt></li>
<li><tt>syslog</tt></li>
<li><tt>email</tt></li>
<li><tt>exec</tt></li>
<li><tt>suspend</tt></li>
<li><tt>single</tt></li>
<li><tt>halt</tt></li>
</ul>
Set this to <tt>email</tt> (instead of the default,
which is <tt>suspend</tt>) as it is more likely to get prompt attention. Acceptable values
also include <tt>suspend</tt>, <tt>single</tt>, and <tt>halt</tt>.
</description>
<ocil clause="the system is not configured to send an email to the system administrator when
disk space is starting to run low">
Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
determine if the system is configured to email the administrator when
disk space is starting to run low:
<tt>$ sudo grep space_left_action /etc/audit/auditd.conf</tt>
<pre>space_left_action</pre>
Acceptable values are <tt>email</tt>, <tt>suspend</tt>, <tt>single</tt>, and <tt>halt</tt>.
</ocil>
<rationale>Notifying administrators of an impending disk space problem may
allow them to take corrective action prior to any disruption.</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="auditd_data_retention_space_left_action" value="var_auditd_space_left_action"/>
<ref nist="AU-1(b),AU-4,AU-5(b),IR-5" disa="140,143" />
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="auditd_data_retention_admin_space_left_action" severity="medium">
<title>Configure auditd admin_space_left Action on Low Disk Space</title>
<description>The <tt>auditd</tt> service can be configured to take an action
when disk space is running low but prior to running out of space completely. 
Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line,
substituting <i>ACTION</i> appropriately:
<pre>admin_space_left_action = <i>ACTION</i></pre>
Set this value to <tt>single</tt> to cause the system to switch to single user
mode for corrective action. Acceptable values also include <tt>suspend</tt> and
<tt>halt</tt>. For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for <i>ACTION</i> are described in the
<tt>auditd.conf</tt> man page.
</description>
<ocil clause="the system is not configured to switch to single user
mode for corrective action">
Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
determine if the system is configured to either suspend, switch to single user mode,
or halt when disk space has run low:
<pre>admin_space_left_action single</pre>
</ocil>
<rationale>Administrators should be made aware of an inability to record
audit records. If a separate partition or logical volume of adequate size
is used, running low on space for audit records should never occur.
</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="auditd_data_retention_admin_space_left_action" value="var_auditd_admin_space_left_action" />
<ref nist="AU-1(b),AU-4,AU-5(b),IR-5" disa="140,1343" />
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="auditd_data_retention_action_mail_acct" severity="medium">
<title>Configure auditd mail_acct Action on Low Disk Space</title>
<description>The <tt>auditd</tt> service can be configured to send email to
a designated account in certain situations. Add or correct the following line
in <tt>/etc/audit/auditd.conf</tt> to ensure that administrators are notified
via email for those situations:
<pre>action_mail_acct = <sub idref="var_auditd_action_mail_acct" /></pre>
</description>
<ocil clause="auditd is not configured to send emails per identified actions">
Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
determine if the system is configured to send email to an
account when it needs to notify an administrator:
<pre>action_mail_acct = root</pre>
</ocil>
<rationale>Email sent to the root account is typically aliased to the
administrators of the system, who can take appropriate action.</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="auditd_data_retention_action_mail_acct" value="var_auditd_action_mail_acct" />
<ref nist="AU-1(b),AU-4,AU-5(a),IR-5" disa="139,144" />
</Rule>

<Rule id="auditd_data_retention_flush">
<title>Configure auditd flush priority</title>
<description>The <tt>auditd</tt> service can be configured to
synchronously write audit event data to disk. Add or correct the following
line in <tt>/etc/audit/auditd.conf</tt> to ensure that audit event data is
fully synchronized with the log files on the disk:
<pre>flush = <sub idref="var_auditd_flush" /></pre>
</description>
<ocil clause="auditd is not configured to synchronously write audit 
event data to disk">
Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
determine if the system is configured to synchronize audit event data
with the log files on the disk:
<tt>$ sudo grep flush /etc/audit/auditd.conf</tt>
<pre>flush = DATA</pre>
Acceptable values are <tt>DATA</tt>, and <tt>SYNC</tt>. The setting is
case-insensitive.
</ocil>
<rationale>Audit data should be synchronously written to disk to ensure
log integrity. These parameters assure that all audit event data is fully
synchronized with the log files on the disk.</rationale>
<!-- <ident cce="" -->
<oval id="auditd_data_retention_flush" value="var_auditd_flush" />
<ref nist="AU-9,AU-12(1)" disa="1576" />
</Rule>

<Rule id="auditd_audispd_syslog_plugin_activated" severity="medium">
<title>Configure auditd to use audispd's syslog plugin</title>
<description>To configure the <tt>auditd</tt> service to use the
<tt>syslog</tt> plug-in of the <tt>audispd</tt> audit event multiplexor, set
the <tt>active</tt> line in <tt>/etc/audisp/plugins.d/syslog.conf</tt> to
<tt>yes</tt>. Restart the <tt>auditd</tt> service:
<pre>$ sudo service auditd restart</pre>
</description>
<ocil clause="it is not">
To verify the audispd's syslog plugin is active, run the following command:
<pre>$ sudo grep active /etc/audisp/plugins.d/syslog.conf</pre>
If the plugin is active, the output will show <tt>yes</tt>.
</ocil>
<rationale>The auditd service does not include the ability to send audit
records to a centralized server for management directly. It does, however,
include a plug-in for audit event multiplexor (audispd) to pass audit records
to the local syslog server</rationale>
<oval id="auditd_audispd_syslog_plugin_activated" />
<ref nist="AU-1(b),AU-3(2),IR-5" disa="136" />
<ident cce="RHEL7-CCE-TBD" />
</Rule>

</Group>

<Group id="auditd_configure_rules">
<title>Configure <tt>auditd</tt> Rules for Comprehensive Auditing</title>
<description>The <tt>auditd</tt> program can perform comprehensive
monitoring of system activity. This section describes recommended
configuration settings for comprehensive auditing, but a full
description of the auditing system's capabilities is beyond the
scope of this guide. The mailing list <i>linux-audit@redhat.com</i> exists
to facilitate community discussion of the auditing system.
<br /><br />
The audit subsystem supports extensive collection of events, including:
<br />
<ul>
<li>Tracing of arbitrary system calls (identified by name or number)
on entry or exit.</li>
<li>Filtering by PID, UID, call success, system call argument (with
some limitations), etc.</li>
<li>Monitoring of specific files for modifications to the file's
contents or metadata.</li>
</ul>
<br />
Auditing rules at startup are controlled by the file <tt>/etc/audit/audit.rules</tt>.
Add rules to it to meet the auditing requirements for your organization.
Each line in <tt>/etc/audit/audit.rules</tt> represents a series of arguments
that can be passed to <tt>auditctl</tt> and can be individually tested
during runtime. See documentation in <tt>/usr/share/doc/audit-<i>VERSION</i></tt> and
in the related man pages for more details.
<br /><br />
If copying any example audit rulesets from <tt>/usr/share/doc/audit-VERSION</tt>,
be sure to comment out the
lines containing <tt>arch=</tt> which are not appropriate for your system's
architecture. Then review and understand the following rules,
ensuring rules are activated as needed for the appropriate
architecture.
<br /><br />
After reviewing all the rules, reading the following sections, and
editing as needed, the new rules can be activated as follows:
<pre>$ sudo service auditd restart</pre>
</description>

<Group id="audit_time_rules">
<title>Records Events that Modify Date and Time Information</title>
<description>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time. All changes to the system
time should be audited.</description>

<Rule id="audit_rules_time_adjtimex">
<title>Record attempts to alter time through adjtimex</title>
<description>If the <tt>auditd</tt> daemon is configured to use the
<tt>augenrules</tt> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <tt>.rules</tt> in the
directory <tt>/etc/audit/rules.d</tt>:
<pre>-a always,exit -F arch=b32 -S adjtimex -k audit_time_rules</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S adjtimex -k audit_time_rules</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-a always,exit -F arch=b32 -S adjtimex -k audit_time_rules</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S adjtimex -k audit_time_rules</pre>
The -k option allows for the specification of a key in string form that can be
used for better reporting capability through ausearch and aureport. Multiple
system calls can be defined on the same line to save space if desired, but is
not required. See an example of multiple combined syscalls:
<pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rules</pre>
</description>
<ocil clause="the system is not configured to audit time changes">
<audit-syscall-check-macro syscall="adjtimex" />
</ocil>
<rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_time_adjtimex" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" />
<ref disa="1487,169" />
</Rule>

<Rule id="audit_rules_time_settimeofday">
<title>Record attempts to alter time through settimeofday</title>
<description>If the <tt>auditd</tt> daemon is configured to use the
<tt>augenrules</tt> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <tt>.rules</tt> in the
directory <tt>/etc/audit/rules.d</tt>:
<pre>-a always,exit -F arch=b32 -S settimeofday -k audit_time_rules</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S settimeofday -k audit_time_rules</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-a always,exit -F arch=b32 -S settimeofday -k audit_time_rules</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S settimeofday -k audit_time_rules</pre>
The -k option allows for the specification of a key in string form that can be
used for better reporting capability through ausearch and aureport. Multiple
system calls can be defined on the same line to save space if desired, but is
not required. See an example of multiple combined syscalls:
<pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rules</pre>
</description>
<ocil clause="the system is not configured to audit time changes">
<audit-syscall-check-macro syscall="settimeofday" />
</ocil>
<rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_time_settimeofday" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" />
<ref disa="1487,169" />
</Rule>

<Rule id="audit_rules_time_stime">
<title>Record Attempts to Alter Time Through stime</title>
<description>If the <tt>auditd</tt> daemon is configured to use the
<tt>augenrules</tt> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <tt>.rules</tt> in the
directory <tt>/etc/audit/rules.d</tt> for both 32 bit and 64 bit systems:
<pre>-a always,exit -F arch=b32 -S stime -k audit_time_rules</pre>
Since the 64 bit version of the "stime" system call is not defined in the audit
lookup table, the corresponding "-F arch=b64" form of this rule is not expected
to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule
form itself is sufficient for both 32 bit and 64 bit systems). If the
<tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt> utility to
read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file for both 32 bit and 64 bit systems:
<pre>-a always,exit -F arch=b32 -S stime -k audit_time_rules</pre>
Since the 64 bit version of the "stime" system call is not defined in the audit
lookup table, the corresponding "-F arch=b64" form of this rule is not expected
to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule
form itself is sufficient for both 32 bit and 64 bit systems). The -k option
allows for the specification of a key in string form that can be used for
better reporting capability through ausearch and aureport. Multiple system
calls can be defined on the same line to save space if desired, but is not
required. See an example of multiple combined system calls:
<pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rules</pre>
</description>
<ocil clause="the system is not configured to audit time changes">
If the system is not configured to audit time changes, this is a finding.
If the system is 64-bit only, this is not applicable<br />
<audit-syscall-check-macro syscall="stime" />
</ocil>
<rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_time_stime" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" />
<ref disa="1487,169" />
</Rule>

<Rule id="audit_rules_time_clock_settime">
<title>Record Attempts to Alter Time Through clock_settime</title>
<description>If the <tt>auditd</tt> daemon is configured to use the
<tt>augenrules</tt> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <tt>.rules</tt> in the
directory <tt>/etc/audit/rules.d</tt>:
<pre>-a always,exit -F arch=b32 -S clock_settime -k audit_time_rules</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S clock_settime -k audit_time_rules</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-a always,exit -F arch=b32 -S clock_settime -k audit_time_rules</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S clock_settime -k audit_time_rules</pre>
The -k option allows for the specification of a key in string form that can
be used for better reporting capability through ausearch and aureport.
Multiple system calls can be defined on the same line to save space if
desired, but is not required. See an example of multiple combined syscalls:
<pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rules</pre>
</description>
<ocil clause="the system is not configured to audit time changes">
<audit-syscall-check-macro syscall="clock_settime" />
</ocil>
<rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_time_clock_settime" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" />
<ref disa="1487,169" />
</Rule>

<Rule id="audit_rules_time_watch_localtime">
<title>Record Attempts to Alter the localtime File</title>
<description>If the <tt>auditd</tt> daemon is configured to use the
<tt>augenrules</tt> program to read audit rules during daemon startup (the default),
add the following line to a file with suffix <tt>.rules</tt> in the directory
<tt>/etc/audit/rules.d</tt>:
<pre>-w /etc/localtime -p wa -k audit_time_rules</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-w /etc/localtime -p wa -k audit_time_rules</pre>
The -k option allows for the specification of a key in string form that can
be used for better reporting capability through ausearch and aureport and
should always be used.
</description>
<ocil clause="the system is not configured to audit time changes">
To determine if the system is configured to audit attempts to
alter time via the /etc/localtime file, run the following
command:
<pre>$ sudo auditctl -l | grep "watch=/etc/localtime"</pre>
If the system is configured to audit this activity, it will return a line.
</ocil>
<rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_time_watch_localtime" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(b),IR-5" />
<ref disa="1487,169" />
</Rule>
</Group><!--End <Group id="audit_time_rules"> -->

<Rule id="audit_rules_usergroup_modification">
<title>Record Events that Modify User/Group Information</title>
<description>If the <tt>auditd</tt> daemon is configured to use the
<tt>augenrules</tt> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <tt>.rules</tt> in the
directory <tt>/etc/audit/rules.d</tt>, in order to capture events that modify
account changes:
<pre>-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following lines to
<tt>/etc/audit/audit.rules</tt> file, in order to capture events that modify
account changes:
<pre>-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</pre>
</description>
<ocil clause="the system is not configured to audit account changes">
To determine if the system is configured to audit account changes,
run the following command:
<pre>auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'</pre>
If the system is configured to watch for account changes, lines should be returned for
each file specified (and with <tt>perm=wa</tt> for each).
</ocil>
<rationale>In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</rationale>
<ident cce="27192-4" />
<oval id="audit_rules_usergroup_modification" />
<ref nist="AC-2(4),AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="18,172,1403,1404,1405,1684,1683,1685,1686" ossrg="476,239" />
</Rule>

<Rule id="audit_rules_networkconfig_modification">
<title>Record Events that Modify the System's Network Environment</title>
<description>If the <tt>auditd</tt> daemon is configured to use the
<tt>augenrules</tt> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <tt>.rules</tt> in the
directory <tt>/etc/audit/rules.d</tt>, setting ARCH to either b32 or b64 as
appropriate for your system:
<pre>-a always,exit -F arch=ARCH -S sethostname -S setdomainname -k audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following lines to
<tt>/etc/audit/audit.rules</tt> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<pre>-a always,exit -F arch=ARCH -S sethostname -S setdomainname -k audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification</pre>
</description>
<ocil clause="the system is not configured to audit changes of the network configuration">
To determine if the system is configured to audit changes to its network configuration,
run the following command:
<pre>auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'</pre>
If the system is configured to watch for network configuration changes, a line should be returned for
each file specified (and <tt>perm=wa</tt> should be indicated for each).
</ocil>
<rationale>The network environment should not be modified by anything other
than administrator action. Any change to network parameters should be
audited.</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_networkconfig_modification" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" />
</Rule>

<Rule id="file_permissions_var_log_audit">
<title>System Audit Logs Must Have Mode 0640 or Less Permissive</title>
<description>
Change the mode of the audit log files with the following command:
<pre>$ sudo chmod 0640 <i>audit_file</i></pre>
</description>
<ocil clause="any are more permissive">
Run the following command to check the mode of the system audit logs:
<pre>$ sudo ls -l /var/log/audit</pre>
Audit logs must be mode 0640 or less permissive.
</ocil>
<rationale>
If users can write to audit logs, audit trails can be modified or destroyed.
</rationale>
<ident cce="27004-1" />
<oval id="file_permissions_var_log_audit" />
<ref nist="AC-6,AU-1(b),AU-9,IR-5" disa="" />
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="file_ownership_var_log_audit">
<title>System Audit Logs Must Be Owned By Root</title>
<description>
<fileowner-desc-macro file="/var/log" owner="root"/>
</description>
<ocil>
<fileowner-check-macro file="/var/log" owner="root"/>
</ocil>
<rationale>Failure to give ownership of the audit log files to root allows the designated
owner, and unauthorized users, potential access to sensitive information.</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="file_ownership_var_log_audit" />
<ref nist="AC-6,AU-1(b),AU-9,IR-5" disa="166" />
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="audit_rules_mac_modification">
<title>Record Events that Modify the System's Mandatory Access Controls</title>
<description>If the <tt>auditd</tt> daemon is configured to use the
<tt>augenrules</tt> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <tt>.rules</tt> in the
directory <tt>/etc/audit/rules.d</tt>:
<pre>-w /etc/selinux/ -p wa -k MAC-policy</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-w /etc/selinux/ -p wa -k MAC-policy</pre>
</description>
<ocil clause="the system is not configured to audit attempts to change the MAC policy">
To determine if the system is configured to audit changes to its SELinux
configuration files, run the following command:
<pre>$ sudo auditctl -l | grep "dir=/etc/selinux"</pre>
If the system is configured to watch for changes to its SELinux
configuration, a line should be returned (including
<tt>perm=wa</tt> indicating permissions that are watched).
</ocil>
<rationale>The system's mandatory access policy (SELinux) should not be
arbitrarily changed by anything other than administrator action. All changes to
MAC policy should be audited.</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_mac_modification" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" />
</Rule>

<Group id="audit_dac_actions">
<title>Record Events that Modify the System's Discretionary Access Controls</title>
<description>At a minimum the audit system should collect file permission
changes for all users and root.  Note that the "-F arch=b32" lines should be
present even on a 64 bit system.  These commands identify system calls for
auditing.  Even if the system is 64 bit it can still execute 32 bit system
calls.  Additionally, these rules can be configured in a number of ways while
still achieving the desired effect.  An example of this is that the "-S" calls
could be split up and placed on separate lines, however, this is less efficient.
Add the following to <tt>/etc/audit/audit.rules</tt>:
<pre>-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod
    -a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod
    -a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If your system is 64 bit then these lines should be duplicated and the
arch=b32 replaced with arch=b64 as follows:
<pre>-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod
    -a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod
    -a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
</description>
<rationale>The changing of file permissions could indicate that a user is
attempting to gain access to information that would otherwise be disallowed.
Auditing DAC modifications can facilitate the identification of patterns of
abuse among both authorized and unauthorized users.</rationale>

<Rule id="audit_rules_dac_modification_chmod">
<title>Record Events that Modify the System's Discretionary Access Controls - chmod</title>
<description>At a minimum the audit system should collect file permission
changes for all users and root. If the <tt>auditd</tt> daemon is configured to
use the <tt>augenrules</tt> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <tt>.rules</tt> in
the directory <tt>/etc/audit/rules.d</tt>:
<pre>-a always,exit -F arch=b32 -S chmod -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S chmod  -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-a always,exit -F arch=b32 -S chmod -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S chmod  -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
</description>
<rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
<ocil clause="the system is not configured to audit permission changes">
<audit-syscall-check-macro syscall="chmod" />
</ocil>
<warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_dac_modification_chmod" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="126"/>
</Rule>

<Rule id="audit_rules_dac_modification_chown">
<title>Record Events that Modify the System's Discretionary Access Controls - chown</title>
<description>At a minimum the audit system should collect file permission
changes for all users and root. If the <tt>auditd</tt> daemon is configured to
use the <tt>augenrules</tt> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <tt>.rules</tt> in
the directory <tt>/etc/audit/rules.d</tt>:
<pre>-a always,exit -F arch=b32 -S chown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S chown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-a always,exit -F arch=b32 -S chown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S chown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
</description>
<ocil>
<audit-syscall-check-macro syscall="chown" />
</ocil>
<rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
<warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_dac_modification_chown" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="126"/>
</Rule>

<Rule id="audit_rules_dac_modification_fchmod">
<title>Record Events that Modify the System's Discretionary Access Controls - fchmod</title>
<description>At a minimum the audit system should collect file permission
changes for all users and root. If the <tt>auditd</tt> daemon is configured to
use the <tt>augenrules</tt> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <tt>.rules</tt> in
the directory <tt>/etc/audit/rules.d</tt>:
<pre>-a always,exit -F arch=b32 -S fchmod -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S fchmod -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-a always,exit -F arch=b32 -S fchmod -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S fchmod -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
</description>
<ocil>
<audit-syscall-check-macro syscall="fchmod" />
</ocil>
<rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
<warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_dac_modification_fchmod" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="126"/>
</Rule>

<Rule id="audit_rules_dac_modification_fchmodat">
<title>Record Events that Modify the System's Discretionary Access Controls - fchmodat</title>
<description>At a minimum the audit system should collect file permission
changes for all users and root. If the <tt>auditd</tt> daemon is configured to
use the <tt>augenrules</tt> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <tt>.rules</tt> in
the directory <tt>/etc/audit/rules.d</tt>:
<pre>-a always,exit -F arch=b32 -S fchmodat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S fchmodat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-a always,exit -F arch=b32 -S fchmodat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S fchmodat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
</description>
<ocil>
<audit-syscall-check-macro syscall="fchmodat" />
</ocil>
<rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
<warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_dac_modification_fchmodat" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="126"/>
</Rule>

<Rule id="audit_rules_dac_modification_fchown">
<title>Record Events that Modify the System's Discretionary Access Controls - fchown</title>
<description>At a minimum the audit system should collect file permission
changes for all users and root. If the <tt>auditd</tt> daemon is configured
to use the <tt>augenrules</tt> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
<pre>-a always,exit -F arch=b32 -S fchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S fchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-a always,exit -F arch=b32 -S fchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S fchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
</description>
<ocil>
<audit-syscall-check-macro syscall="fchown" />
</ocil>
<rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
<warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_dac_modification_fchown" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="126"/>
</Rule>

<Rule id="audit_rules_dac_modification_fchownat">
<title>Record Events that Modify the System's Discretionary Access Controls - fchownat</title>
<description>At a minimum the audit system should collect file permission
changes for all users and root. If the <tt>auditd</tt> daemon is configured
to use the <tt>augenrules</tt> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
<pre>-a always,exit -F arch=b32 -S fchownat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S fchownat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-a always,exit -F arch=b32 -S fchownat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S fchownat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
</description>
<ocil>
<audit-syscall-check-macro syscall="fchownat" />
</ocil>
<rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
<warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_dac_modification_fchownat" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="126"/>
</Rule>

<Rule id="audit_rules_dac_modification_fremovexattr">
<title>Record Events that Modify the System's Discretionary Access Controls - fremovexattr</title>
<description>At a minimum the audit system should collect file permission
changes for all users and root. If the <tt>auditd</tt> daemon is configured
to use the <tt>augenrules</tt> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
<pre>-a always,exit -F arch=b32 -S fremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S fremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-a always,exit -F arch=b32 -S fremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S fremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
</description>
<ocil>
<audit-syscall-check-macro syscall="fremovexattr" />
</ocil>
<rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
<warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_dac_modification_fremovexattr" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="126"/>
</Rule>

<Rule id="audit_rules_dac_modification_fsetxattr">
<title>Record Events that Modify the System's Discretionary Access Controls - fsetxattr</title>
<description>At a minimum the audit system should collect file permission
changes for all users and root. If the <tt>auditd</tt> daemon is configured
to use the <tt>augenrules</tt> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
<pre>-a always,exit -F arch=b32 -S fsetxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S fsetxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-a always,exit -F arch=b32 -S fsetxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S fsetxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
</description>
<ocil>
<audit-syscall-check-macro syscall="fsetxattr" />
</ocil>
<rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
<warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_dac_modification_fsetxattr" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="126"/>
</Rule>

<Rule id="audit_rules_dac_modification_lchown">
<title>Record Events that Modify the System's Discretionary Access Controls - lchown</title>
<description>At a minimum the audit system should collect file permission
changes for all users and root. If the <tt>auditd</tt> daemon is configured
to use the <tt>augenrules</tt> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
<pre>-a always,exit -F arch=b32 -S lchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S lchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-a always,exit -F arch=b32 -S lchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S lchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
</description>
<ocil>
<audit-syscall-check-macro syscall="lchown" />
</ocil>
<rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
<warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_dac_modification_lchown" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="126"/>
</Rule>

<Rule id="audit_rules_dac_modification_lremovexattr">
<title>Record Events that Modify the System's Discretionary Access Controls - lremovexattr</title>
<description>At a minimum the audit system should collect file permission
changes for all users and root. If the <tt>auditd</tt> daemon is configured
to use the <tt>augenrules</tt> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
<pre>-a always,exit -F arch=b32 -S lremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S lremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-a always,exit -F arch=b32 -S lremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S lremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
</description>
<ocil>
<audit-syscall-check-macro syscall="lremovexattr" />
</ocil>
<rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
<warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_dac_modification_lremovexattr" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="126"/>
</Rule>

<Rule id="audit_rules_dac_modification_lsetxattr">
<title>Record Events that Modify the System's Discretionary Access Controls - lsetxattr</title>
<description>At a minimum the audit system should collect file permission
changes for all users and root. If the <tt>auditd</tt> daemon is configured
to use the <tt>augenrules</tt> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
<pre>-a always,exit -F arch=b32 -S lsetxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S lsetxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-a always,exit -F arch=b32 -S lsetxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S lsetxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
</description>
<ocil>
<audit-syscall-check-macro syscall="lsetxattr" />
</ocil>
<rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
<warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_dac_modification_lsetxattr" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="126"/>
</Rule>

<Rule id="audit_rules_dac_modification_removexattr">
<title>Record Events that Modify the System's Discretionary Access Controls - removexattr</title>
<description>At a minimum the audit system should collect file permission
changes for all users and root. If the <tt>auditd</tt> daemon is configured
to use the <tt>augenrules</tt> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
<pre>-a always,exit -F arch=b32 -S removexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S removexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-a always,exit -F arch=b32 -S removexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S removexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
</description>
<ocil>
<audit-syscall-check-macro syscall="removexattr" />
</ocil>
<rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
<warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_dac_modification_removexattr" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="126"/>
</Rule>

<Rule id="audit_rules_dac_modification_setxattr">
<title>Record Events that Modify the System's Discretionary Access Controls - setxattr</title>
<description>At a minimum the audit system should collect file permission
changes for all users and root. If the <tt>auditd</tt> daemon is configured
to use the <tt>augenrules</tt> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
<pre>-a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
If the system is 64 bit then also add the following line:
<pre>-a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod</pre>
</description>
<ocil>
<audit-syscall-check-macro syscall="setxattr" />
</ocil>
<rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
<warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_dac_modification_setxattr" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="126"/>
</Rule>

</Group> <!-- <Group id="audit_dac_actions"> -->

<Rule id="audit_rules_login_events">
<title>Record Attempts to Alter Logon and Logout Events</title>
<description>The audit system already collects login information for all users
and root. If the <tt>auditd</tt> daemon is configured to use the
<tt>augenrules</tt> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <tt>.rules</tt> in the
directory <tt>/etc/audit/rules.d</tt> in order to watch for attempted manual
edits of files involved in storing logon events:
<pre>-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following lines to
<tt>/etc/audit/audit.rules</tt> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<pre>-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins</pre>
</description>
<rationale>Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</rationale>
<ident cce="27204-7" />
<oval id="audit_rules_login_events" />
<ref nist="AC-17(7),AU-1(b),AU-12(a),AU-12(c),IR-5" />
</Rule>

<Rule id="audit_rules_session_events">
<title>Record Attempts to Alter Process and Session Initiation Information</title>
<description>The audit system already collects process information for all
users and root. If the <tt>auditd</tt> daemon is configured to use the
<tt>augenrules</tt> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <tt>.rules</tt> in the
directory <tt>/etc/audit/rules.d</tt> in order to watch for attempted manual
edits of files involved in storing such process information:
<pre>-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following lines to
<tt>/etc/audit/audit.rules</tt> file in order to watch for attempted manual
edits of files involved in storing such process information:
<pre>-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session</pre>
</description>
<rationale>Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</rationale>
<ident cce="27301-1" />
<oval id="audit_rules_session_events" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" />
</Rule>

<Rule id="audit_rules_unsuccessful_file_modification">
<title>Ensure <tt>auditd</tt> Collects Unauthorized Access Attempts to Files (unsuccessful)</title>
<description>At a minimum the audit system should collect unauthorized file
accesses for all users and root. If the <tt>auditd</tt> daemon is configured
to use the <tt>augenrules</tt> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
<pre>-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access</pre>
If the system is 64 bit then also add the following lines:
<pre>
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following lines to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access</pre>
If the system is 64 bit then also add the following lines:
<pre>
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access</pre>
</description>
<ocil clause="32-bit and 64-bit system calls to creat, open, openat, open_by_handle_at, truncate, and ftruncate are not audited during EACCES and EPERM">
To verify that the audit system collects unauthorized file accesses, run the following commands:
<pre>$ sudo grep EACCES /etc/audit/audit.rules</pre>
<pre>$ sudo grep EPERM /etc/audit/audit.rules</pre>
</ocil>
<rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_unsuccessful_file_modification" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="126" />
</Rule>

<Rule id="audit_rules_privileged_commands">
<title>Ensure <tt>auditd</tt> Collects Information on the Use of Privileged Commands</title>
<description>At a minimum the audit system should collect the execution of
privileged commands for all users and root. To find the relevant setuid /
setgid programs, run the following command for each local partition
<i>PART</i>:
<pre>$ sudo find <i>PART</i> -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>augenrules</tt>
program to read audit rules during daemon startup (the default), add a line of
the following form to a file with suffix <tt>.rules</tt> in the directory
<tt>/etc/audit/rules.d</tt> for each setuid / setgid program on the system,
replacing the <i>SETUID_PROG_PATH</i> part with the full path of that setuid /
setgid program in the list:
<pre>-a always,exit -F path=<i>SETUID_PROG_PATH</i> -F perm=x -F auid&gt;=1000 -F auid!=4294967295 -k privileged</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add a line of the following
form to <tt>/etc/audit/audit.rules</tt> for each setuid / setgid program on the
system, replacing the <i>SETUID_PROG_PATH</i> part with the full path of that
setuid / setgid program in the list:
<pre>-a always,exit -F path=<i>SETUID_PROG_PATH</i> -F perm=x -F auid&gt;=1000 -F auid!=4294967295 -k privileged</pre>
</description>
<ocil clause="it is not the case">
To verify that auditing of privileged command use is configured, run the
following command for each local partition <i>PART</i> to find relevant
setuid / setgid programs:
<pre>$ sudo find <i>PART</i> -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null</pre>
Run the following command to verify entries in the audit rules for all programs
found with the previous command:
<pre>$ sudo grep path /etc/audit/audit.rules</pre>
It should be the case that all relevant setuid / setgid programs have a line
in the audit rules.
</ocil>
<rationale>Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.
</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_privileged_commands" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-2(4),AU-12(a),AU-12(c),IR-5" disa="40" />
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="audit_rules_media_export">
<title>Ensure <tt>auditd</tt> Collects Information on Exporting to Media (successful)</title>
<description>At a minimum the audit system should collect media exportation
events for all users and root. If the <tt>auditd</tt> daemon is configured to
use the <tt>augenrules</tt> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <tt>.rules</tt> in
the directory <tt>/etc/audit/rules.d</tt>, setting ARCH to either b32 or b64 as
appropriate for your system:
<pre>-a always,exit -F arch=ARCH -S mount -F auid&gt;=1000 -F auid!=4294967295 -k export</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<pre>-a always,exit -F arch=ARCH -S mount -F auid&gt;=1000 -F auid!=4294967295 -k export</pre>
</description>
<ocil clause="there is not output">
To verify that auditing is configured for all media exportation events, run the following command:
<pre>$ sudo auditctl -l | grep syscall | grep mount</pre>
</ocil>
<rationale>The unauthorized exportation of data to external media could result in an information leak
where classified information, Privacy Act information, and intellectual property could be lost. An audit
trail should be created each time a filesystem is mounted to help identify and guard against information
loss.</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_media_export" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="126"/>
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="audit_rules_file_deletion_events">
<title>Ensure <tt>auditd</tt> Collects File Deletion Events by User</title>
<description>At a minimum the audit system should collect file deletion events
for all users and root. If the <tt>auditd</tt> daemon is configured to use the
<tt>augenrules</tt> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <tt>.rules</tt> in the
directory <tt>/etc/audit/rules.d</tt>, setting ARCH to either b32 or b64 as
appropriate for your system:
<pre>-a always,exit -F arch=ARCH -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid&gt;=1000 -F auid!=4294967295 -k delete</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<pre>-a always,exit -F arch=ARCH -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid&gt;=1000 -F auid!=4294967295 -k delete</pre>
</description>
<ocil>
<audit-syscall-check-macro syscall="unlink" />
<audit-syscall-check-macro syscall="unlinkat" />
<audit-syscall-check-macro syscall="rename" />
<audit-syscall-check-macro syscall="renameat" />
</ocil>
<rationale>Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</rationale>
<ident cce="27206-2" />
<oval id="audit_rules_file_deletion_events" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="172" ossrg="468" />
</Rule>

<Rule id="audit_rules_sysadmin_actions">
<title>Ensure <tt>auditd</tt> Collects System Administrator Actions</title>
<description>At a minimum the audit system should collect administrator actions
for all users and root. If the <tt>auditd</tt> daemon is configured to use the
<tt>augenrules</tt> program to read audit rules during daemon startup (the default),
add the following line to a file with suffix <tt>.rules</tt> in the directory
<tt>/etc/audit/rules.d</tt>:
<pre>-w /etc/sudoers -p wa -k actions</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file:
<pre>-w /etc/sudoers -p wa -k actions</pre>
</description>
<ocil clause="there is not output">
To verify that auditing is configured for system administrator actions, run the following command:
<pre>$ sudo auditctl -l | grep "watch=/etc/sudoers"</pre>
</ocil>
<rationale>The actions taken by system administrators should be audited to keep a record
of what was executed on the system, as well as, for accountability purposes.</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="audit_rules_sysadmin_actions" />
<ref nist="AC-2(7)(b),AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="126"/>
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="audit_rules_kernel_module_loading">
<title>Ensure <tt>auditd</tt> Collects Information on Kernel Module Loading and Unloading</title>
<description>If the <tt>auditd</tt> daemon is configured to use the <tt>augenrules</tt> program
to read audit rules during daemon startup (the default), add the following lines to a file
with suffix <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt> to capture kernel module
loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system:
<pre>-w /usr/sbin/insmod -p x -k modules
-w /usr/sbin/rmmod -p x -k modules
-w /usr/sbin/modprobe -p x -k modules
-a always,exit -F arch=<i>ARCH</i> -S init_module -S delete_module -k modules</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt> utility to read audit
rules during daemon startup, add the following lines to <tt>/etc/audit/audit.rules</tt> file
in order to capture kernel module loading and unloading events, setting ARCH to either b32 or
b64 as appropriate for your system:
<pre>-w /usr/sbin/insmod -p x -k modules
-w /usr/sbin/rmmod -p x -k modules
-w /usr/sbin/modprobe -p x -k modules
-a always,exit -F arch=<i>ARCH</i> -S init_module -S delete_module -k modules</pre>
</description>
<ocil>
<audit-syscall-check-macro syscall="init_module" />
<audit-syscall-check-macro syscall="delete_module" />
</ocil>
<rationale>The addition/removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</rationale>
<ident cce="27129-6" />
<oval id="audit_rules_kernel_module_loading" />
<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" disa="172" ossrg="477" />
</Rule>

<Rule id="audit_rules_immutable">
<title>Make the <tt>auditd</tt> Configuration Immutable</title>
<description>If the <tt>auditd</tt> daemon is configured to use the
<tt>augenrules</tt> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <tt>.rules</tt> in the
directory <tt>/etc/audit/rules.d</tt> in order to make the auditd configuration
immutable:
<pre>-e 2</pre>
If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
utility to read audit rules during daemon startup, add the following line to
<tt>/etc/audit/audit.rules</tt> file in order to make the auditd configuration
immutable:
<pre>-e 2</pre>
With this setting, a reboot will be required to change any audit rules.
</description>
<rationale>Making the audit configuration immutable prevents accidental as
well as malicious modification of the audit rules, although it may be
problematic if legitimate changes are needed during system
operation</rationale>
<ident cce="27097-5" />
<oval id="audit_rules_immutable" />
<ref nist="AC-6,AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
</Rule>
</Group>

</Group>
