SV-221824r603260_rule
V-221824
SRG-OS-000471-GPOS-00216
OL07-00-030840
CAT II
10
Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "kmod" command occur.
Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-w /usr/bin/kmod -p x -F auid!=unset -k module-change
The audit daemon must be restarted for the changes to take effect.
Verify the operating system generates audit records when successful/unsuccessful attempts to use the "kmod" command occur.
Check the auditing rules in "/etc/audit/audit.rules" with the following command:
# grep -iw kmod /etc/audit/audit.rules
-w /usr/bin/kmod -p x -F auid!=unset -k module-change
If the command does not return any output, this is a finding.
V-221824
False
OL07-00-030840
Verify the operating system generates audit records when successful/unsuccessful attempts to use the "kmod" command occur.
Check the auditing rules in "/etc/audit/audit.rules" with the following command:
# grep -iw kmod /etc/audit/audit.rules
-w /usr/bin/kmod -p x -F auid!=unset -k module-change
If the command does not return any output, this is a finding.
M
4089