Title

The SUSE operating system must not disable syscall auditing. (Cat II impact)

Discussion

By default, the SUSE operating system includes the "-a task,never" audit rule as a default. This rule suppresses syscall auditing for all tasks started with this rule in effect. Because the audit daemon processes the "audit.rules" file from the top down, this rule supersedes all other defined syscall rules; therefore no syscall auditing can take place on the operating system.

Check Content

Verify syscall auditing has not been disabled: > sudo auditctl -l | grep -i "a task,never" If any results are returned, this is a finding. Verify the default rule "-a task,never" is not statically defined : > sudo grep -rv "^#" /etc/audit/rules.d/ | grep -i "a task,never" If any results are returned, this is a finding.

Fix Text

Remove the "-a task,never" rule from the /etc/audit/rules.d/audit.rules file. The audit daemon must be restarted for the changes to take effect. > sudo systemctl restart auditd.service

Additional Identifiers

Rule ID: SV-217204r646746_rule

Vulnerability ID: V-217204

Group Title: SRG-OS-000480-GPOS-00227

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.