Check: RHEL-09-654210
RHEL 9 STIG:
RHEL-09-654210
(in version v2 r3)
Title
Successful/unsuccessful uses of the umount2 system call in RHEL 9 must generate an audit record. (Cat II impact)
Discussion
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Check Content
To determine if the system is configured to audit calls to the umount2 system call, run the following command: $ sudo auditctl -l | grep umount2 -a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=-1 -F key=privileged-umount -a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=-1 -F key=privileged-umount If no line is returned, this is a finding.
Fix Text
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "umount2" system call by adding or updating the following rules in a file in "/etc/audit/rules.d". -a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -k privileged-umount -a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -k privileged-umount To load the rules to the kernel immediately, use the following command: $ sudo augenrules --load
Additional Identifiers
Rule ID: SV-258216r1045433_rule
Vulnerability ID: V-258216
Group Title: SRG-OS-000037-GPOS-00015
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000130 |
Ensure that audit records contain information that establishes what type of event occurred. |
| CCI-000169 |
Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a on organization-defined information system components. |
| CCI-000172 |
Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3. |
| CCI-002884 |
Log organization-defined audit events for nonlocal maintenance and diagnostic sessions. |