Detections
Analytics
6.2.3.33 Ensure kernel "delete_module" loading unloading and modification is collected
Information
Monitor the loading and unloading of kernel modules. All the loading / listing / dependency checking of modules is done by kmod via symbolic links.The following system calls control loading and unloading of modules:
- delete_module - delete a module
Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of modules.
Monitoring the use of all the various ways to manipulate kernel modules could provide system administrators with evidence that an unauthorized change was made to a kernel module, possibly compromising the security of the system.
Solution
- Add the audit rule(s) for the delete_module system call. The procedure adds a rule for each audit ABI (b64/b32) the running kernel supports and skips any unsupported ABI or system call, so augenrules --load does not error. Run:#!/usr/bin/env bash
{
UID_MIN="$(awk '/^[[:space:]]*UID_MIN/{print $2}' /etc/login.defs)"
for ARCH in b64 b32; do
CALLS=""; for C in delete_module; do ausyscall "$ARCH" "$C" >/dev/null 2>&1 && CALLS="${CALLS:+$CALLS,}$C"; done
[ -n "$CALLS" ] && printf '%s\n' "-a always,exit -F arch=$ARCH -S $CALLS -F auid>=$UID_MIN -F auid!=unset -k kernel_modules"
done >> /etc/audit/rules.d/50-kernel_modules.rules
}
- Merge and load the rules into active configuration:
# augenrules --load
- Check if reboot is required:
# if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi
See Also
Item Details
Audit Name: CIS AlmaLinux OS 9 v3.0.0 L2 Server
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|6.2
Plugin: Unix
Control ID: c7898b392909f7ef463226800ca85f5e7edb3ad64fa336e736a237875edfab87