documentation_complete: true


title: 'Record Access Events to OpenShift Audit Log Directory'

platform: ocp4-master-node

description: |-
    The audit system should collect access events to read the OpenShift audit log directory.
    The following audit rule will assure that access to audit log directory are
    collected.
    <pre>-a always,exit -F dir=/var/log/openshift-apiserver/ -F perm=r -F auid>={{{ auid }}} -F auid!=unset -F key=access-audit-trail</pre>
    If the <tt>auditd</tt> daemon is configured to use the <tt>augenrules</tt>
    program to read audit rules during daemon startup (the default), add the
    rule to a file with suffix <tt>.rules</tt> in the directory
    <tt>/etc/audit/rules.d</tt>.
    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
    utility to read audit rules during daemon startup, add the rule to
    <tt>/etc/audit/audit.rules</tt> file.

rationale: |-
    Attempts to read the logs should be recorded, suspicious access to audit log files could be an indicator of malicious activity on a system.
    Auditing these events could serve as evidence of potential system compromise.'

references:
    nist: AU-2(d),AU-12(c),AC-6(9),CM-6(a)
    srg: SRG-APP-000343-CTR-000780

identifiers:
    cce@ocp4: CCE-90632-1

severity: medium

ocil_clause: "no line is returned"

ocil: |-
    To determine if the system is configured to audit accesses to
    <code>/var/log/openshift-apiserver</code> directory, run the following command:
    <pre space="preserve">$ sudo grep "dir=/var/log/openshift-apiserver" /etc/audit/audit.rules</pre>
    If the system is configured to audit this activity, it will return a line.
