Detections
Analytics

1.185 RHEL-10-500300

Information

RHEL 10 must generate audit records for successful and unsuccessful uses of the "execve" system call.

GROUP ID: V-281116RULE ID: SV-281116r1166300

Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations.

Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat.

Satisfies: SRG-OS-000326-GPOS-00126, SRG-OS-000327-GPOS-00127, SRG-OS-000755-GPOS-00220

Solution

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "execve" system call.

Add or update the following file system rules to "/etc/audit/rules.d/audit.rules":

-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv

Restart the audit daemon with the following command for the changes to take effect:

$ sudo service auditd restart

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(8), 800-53|AC-6(9), CAT|II, CCI|CCI-002233, CCI|CCI-002234, CCI|CCI-004188, Rule-ID|SV-281116r1166300_rule, STIG-ID|RHEL-10-500300, Vuln-ID|V-281116

Plugin: Unix

Control ID: ce7b46438c50565003ac740d3b886c90523384c8e8e968084b8fb59d8a093be1