Detections
Analytics
6.2.3.32 Ensure kernel "init_module" and "finit_module" loading unloading and modification is collected
Information
The following system calls control loading and unloading of modules:- init_module - load a module
- finit_module - load a module (used when the overhead of using cryptographically signed modules to determine the authenticity of a module can be avoided)
Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of modules.
Monitoring the use of all the various ways to manipulate kernel modules could provide system administrators with evidence that an unauthorized change was made to a kernel module, possibly compromising the security of the system.
Solution
- Add the audit rule(s) for the init_module and finit_module system calls. The procedure adds a rule for each audit ABI (b64/b32) the running kernel supports and skips any unsupported ABI or system call, so augenrules --load does not error. Run:#!/usr/bin/env bash
{
UID_MIN="$(awk '/^[[:space:]]*UID_MIN/{print $2}' /etc/login.defs)"
for ARCH in b64 b32; do
CALLS=""; for C in init_module finit_module; do ausyscall "$ARCH" "$C" >/dev/null 2>&1 && CALLS="${CALLS:+$CALLS,}$C"; done
[ -n "$CALLS" ] && printf '%s\n' "-a always,exit -F arch=$ARCH -S $CALLS -F auid>=$UID_MIN -F auid!=unset -k kernel_modules"
done >> /etc/audit/rules.d/50-kernel_modules.rules
}
- Merge and load the rules into active configuration:
# augenrules --load
- Check if reboot is required:
# if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi
See Also
Item Details
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|6.2
Plugin: Unix
Control ID: 3775fa9a0ad18a524c9382c544f3ce71316acee050ed1dd814c88d5745e177aa