documentation_complete: true

title: 'Make the auditd Configuration Immutable'

description: |-
    If the <tt>auditd</tt> daemon is configured to use the
    <tt>augenrules</tt> program to read audit rules during daemon startup (the
    default), add the following line to a file with suffix <tt>.rules</tt> in the
    directory <tt>/etc/audit/rules.d</tt> in order to make the auditd configuration
    immutable:
    <pre>-e 2</pre>
    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
    utility to read audit rules during daemon startup, add the following line to
    <tt>/etc/audit/audit.rules</tt> file in order to make the auditd configuration
    immutable:
    <pre>-e 2</pre>
    With this setting, a reboot will be required to change any audit rules.

rationale: |-
    Making the audit configuration immutable prevents accidental as
    well as malicious modification of the audit rules, although it may be
    problematic if legitimate changes are needed during system
    operation.

severity: medium

identifiers:
    cce@rhcos4: CCE-82668-5
    cce@rhel8: CCE-80708-1
    cce@rhel9: CCE-83716-1
    cce@rhel10: CCE-89816-3
    cce@sle12: CCE-91554-6
    cce@sle15: CCE-85831-6
    cce@slmicro5: CCE-93869-6

references:
    cis-csc: 1,11,12,13,14,15,16,18,19,3,4,5,6,7,8
    cis@sle12: 4.1.17
    cis@sle15: 4.1.17
    cjis: 5.4.1.1
    cobit5: APO01.06,APO10.01,APO10.03,APO10.04,APO10.05,APO11.04,APO12.06,BAI03.05,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,DSS06.02,MEA01.01,MEA01.02,MEA01.03,MEA01.04,MEA01.05,MEA02.01
    cui: 3.3.1,3.4.3
    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.310(a)(2)(iv),164.312(d),164.310(d)(2)(iii),164.312(b),164.312(e)
    isa-62443-2009: 4.2.3.10,4.3.2.6.7,4.3.3.3.9,4.3.3.5.8,4.3.3.7.3,4.3.4.4.7,4.3.4.5.6,4.3.4.5.7,4.3.4.5.8,4.4.2.1,4.4.2.2,4.4.2.4
    isa-62443-2013: 'SR 2.1,SR 2.10,SR 2.11,SR 2.12,SR 2.8,SR 2.9,SR 5.2,SR 6.1'
    iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.15.2.1,A.15.2.2,A.16.1.4,A.16.1.5,A.16.1.7,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
    nist: AC-6(9),CM-6(a)
    nist-csf: DE.AE-3,DE.AE-5,ID.SC-4,PR.AC-4,PR.DS-5,PR.PT-1,RS.AN-1,RS.AN-4
    pcidss: Req-10.5.2
    srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-APP-000119-CTR-000245,SRG-APP-000120-CTR-000250
    stigid@ol8: OL08-00-030121

ocil_clause: 'the audit system is not set to be immutable by adding the "-e 2" option to the end of "/etc/audit/audit.rules"'

ocil: |-
    Verify the audit system prevents unauthorized changes with the following command:
    <pre>
    $ sudo grep "^\s*[^#]" /etc/audit/audit.rules | tail -1
    -e 2
    </pre>

fixtext: |-
    Configure the audit system to set the audit rules to be immutable by adding the following line to end of "/etc/audit/rules.d/audit.rules"

    -e 2

    The audit daemon must be restarted for the changes to take effect.

srg_requirement: '{{{ full_name }}} audit system must protect auditing rules from unauthorized change.'
