SV-221832r603260_rule
V-221832
SRG-OS-000466-GPOS-00210
OL07-00-030900
CAT II
10
Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "rmdir" syscall occur.
Add the following rules in "/etc/audit/rules.d/audit.rules":
-a always,exit -F arch=b32 -S rmdir -F auid>=1000 -F auid!=unset -k delete
-a always,exit -F arch=b64 -S rmdir -F auid>=1000 -F auid!=unset -k delete
The audit daemon must be restarted for the changes to take effect.
Verify the operating system generates audit records when successful/unsuccessful attempts to use the "rmdir" syscall occur.
Check the file system rules in "/etc/audit/audit.rules" with the following commands:
# grep -iw rmdir /etc/audit/audit.rules
-a always,exit -F arch=b32 -S rmdir -F auid>=1000 -F auid!=unset -k delete
-a always,exit -F arch=b64 -S rmdir -F auid>=1000 -F auid!=unset -k delete
If both the "b32" and "b64" audit rules are not defined for the "rmdir" syscall, this is a finding.
V-221832
False
OL07-00-030900
Verify the operating system generates audit records when successful/unsuccessful attempts to use the "rmdir" syscall occur.
Check the file system rules in "/etc/audit/audit.rules" with the following commands:
# grep -iw rmdir /etc/audit/audit.rules
-a always,exit -F arch=b32 -S rmdir -F auid>=1000 -F auid!=unset -k delete
-a always,exit -F arch=b64 -S rmdir -F auid>=1000 -F auid!=unset -k delete
If both the "b32" and "b64" audit rules are not defined for the "rmdir" syscall, this is a finding.
M
4089