Detections
Analytics

4.1.3.27 Ensure audit of unlink syscall - 64 bit

Information

The operating system must audit all uses of the unlink syscall.

Rationale:

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.

Solution

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the unlink syscall occur.
Add the following rules in /etc/audit/rules.d/audit.rules:
Example: vim /etc/audit/rules.d/audit.rules
Add, uncomment or update the following line depending on your system architecture:
Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured.

-a always,exit -F arch=b32 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete

-a always,exit -F arch=b64 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete

The audit daemon must be restarted for the changes to take effect.

# service auditd restart

See Also

https://workbench.cisecurity.org/files/3636

Item Details

Category: AUDIT AND ACCOUNTABILITY, MAINTENANCE

References: 800-53|AU-12c., 800-53|MA-4(1)(a), CCI|CCI-000172, CCI|CCI-002884, CSCv7|6.2, Rule-ID|SV-204572r603261_rule, STIG-ID|RHEL-07-030910

Plugin: Unix

Control ID: a680d1d94f0d1a806622d4045737ba84ca7277a07425c7c03e7338abb375ae6d