SV-217217r603262_rule
V-217217
SRG-OS-000037-GPOS-00015
SLES-12-020360
CAT II
10
Configure the SUSE operating system to audit the execution of the module management program "kmod" by adding the following line to "/etc/audit/rules.d/audit.rules":
-w /usr/bin/kmod -p x -k modules
The audit daemon must be restarted for any changes to take effect.
# sudo systemctl restart auditd.service
Verify the SUSE operating system generates an audit record for all uses of the "kmod" command.
Check that the following command call is being audited by performing the following command on the system rules in "/etc/audit/audit.rules":
# sudo grep kmod /etc/audit/audit.rules
-w /usr/bin/kmod -p x -k modules
If the system is configured to audit the execution of the module management program "kmod", the command will return a line.
If the command does not return a line, or the line is commented out, this is a finding.
V-217217
False
SLES-12-020360
Verify the SUSE operating system generates an audit record for all uses of the "kmod" command.
Check that the following command call is being audited by performing the following command on the system rules in "/etc/audit/audit.rules":
# sudo grep kmod /etc/audit/audit.rules
-w /usr/bin/kmod -p x -k modules
If the system is configured to audit the execution of the module management program "kmod", the command will return a line.
If the command does not return a line, or the line is commented out, this is a finding.
M
4033