Detections
Analytics

6.2.3.31 Ensure kernel module loading unloading and modification is collected

Information

Monitor the loading and unloading of kernel modules. All the loading / listing / dependency checking of modules is done by kmod via symbolic links.

Monitoring the use of all the various ways to manipulate kernel modules could provide system administrators with evidence that an unauthorized change was made to a kernel module, possibly compromising the security of the system.

Solution

- Add the audit rule(s) that monitor use of the /usr/bin/kmod command. The procedure adds each rule only for targets that exist, so augenrules --load does not error. Run:

#!/usr/bin/env bash

{
 UID_MIN="$(awk '/^[[:space:]]*UID_MIN/{print $2}' /etc/login.defs)"
 [ -e /usr/bin/kmod ] && printf '%s\n' "-a always,exit -S all -F path=/usr/bin/kmod -F perm=x -F auid>=$UID_MIN -F auid!=unset -k kernel_modules"
} >> /etc/audit/rules.d/50-kernel_modules.rules

 - Merge and load the rules into active configuration:

# augenrules --load

 - Check if reboot is required:

# if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

See Also

https://workbench.cisecurity.org/benchmarks/27893

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, 800-53|AU-12a., CSCv7|6.2

Plugin: Unix

Control ID: b35b0ebbc567f502aa091f15c9cf671ae0b855da448af893d0e64402383aa347