Detections
Analytics

SLES-12-020199 - The SUSE operating system must not disable syscall auditing.

Information

By default, the SUSE operating system includes the '-a task,never' audit rule as a default. This rule suppresses syscall auditing for all tasks started with this rule in effect. Because the audit daemon processes the 'audit.rules' file from the top down, this rule supersedes all other defined syscall rules; therefore no syscall auditing can take place on the operating system.

Solution

Remove the '-a task,never' rule from the /etc/audit/rules.d/audit.rules file.

The audit daemon must be restarted for the changes to take effect.

> sudo systemctl restart auditd.service

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SLES_12_V3R4_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-217204r991589_rule, STIG-ID|SLES-12-020199, STIG-Legacy|SV-106365, STIG-Legacy|V-97227, Vuln-ID|V-217204

Plugin: Unix

Control ID: 473194362e92d6a90018a9de956aa36ac5da8cff61521a99396406ce1e3f3256