PHTN-30-000020 - The Photon operating system must generate audit records when successful/unsuccessful attempts to access privileges occur.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Audit records can be generated from various components within the information system (e.g., module or policy filter).

Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210, SRG-OS-000468-GPOS-00212

Solution

Navigate to and open:

/etc/audit/rules.d/audit.STIG.rules

Add the following lines:

-a always,exit -F arch=b64 -S chmod,fchmod,chown,fchown,fchownat,fchmodat -F auid>=1000 -F auid!=4294967295 -F key=perm_mod
-a always,exit -F arch=b64 -S chmod,fchmod,chown,fchown,lchown,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr,fchownat,fchmodat -F key=perm_mod
-a always,exit -F arch=b32 -S chmod,fchmod,fchown,chown,fchownat,fchmodat -F auid>=1000 -F auid!=4294967295 -F key=perm_mod
-a always,exit -F arch=b32 -S chmod,lchown,fchmod,fchown,chown,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr,fchownat,fchmodat -F key=perm_mod

At the command line, run the following command to load the new audit rules:

# /sbin/augenrules --load

Note: A new 'audit.STIG.rules' file is provided for placement in '/etc/audit/rules.d' that contains all rules needed for auditd.

Note: An older 'audit.STIG.rules' may exist if the file exists and references older 'GEN' SRG IDs. This file can be removed and replaced as necessary with an updated one.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y23M07_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000172, CCI|CCI-002884, Rule-ID|SV-256497r887165_rule, STIG-ID|PHTN-30-000020, Vuln-ID|V-256497

Plugin: Unix

Control ID: 56868c0c250cb3d639a9e084f475ac6023c2f5506b81248b3121463069e2f92b