The SUSE operating system must not disable syscall auditing.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-234981 | SLES-15-030820 | SV-234981r991589_rule | CCI-000366 | medium |
| Description | ||||
| By default, the SUSE operating system includes the "-a task,never" audit rule as a default. This rule suppresses syscall auditing for all tasks started with this rule in effect. Because the audit daemon processes the "audit.rules" file from the top down, this rule supersedes all other defined syscall rules; therefore no syscall auditing can take place on the operating system. | ||||
| STIG | Date | |||
| SUSE Linux Enterprise Server 15 Security Technical Implementation Guide | 2025-05-14 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-6
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.4.1
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.4.2
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000366
1.00
- DISA · 2 · disa_xccdf · related
Details
Check Text (C-234981r991589_chk)
Verify syscall auditing has not been disabled:
> auditctl -l | grep -i "a task,never"
If any results are returned, this is a finding.
Verify the default rule "-a task,never" is not statically defined :
> grep -rv "^#" /etc/audit/rules.d/ | grep -i "a task,never"
If any results are returned, this is a finding.
Fix Text (F-38132r619213_fix)
Remove the "-a task,never" rule from the /etc/audit/rules.d/audit.rules file.
The audit daemon must be restarted for the changes to take effect.
> sudo systemctl restart auditd.service