{{{ oval_metadata("The audit rules should be configured to log information about kernel module loading and unloading.", rule_title=rule_title) }}} {{% macro arkml_oval(audit_type, bits, name) %}} {{% if audit_type == "augenrules" %}} ^/etc/audit/rules\.d/.*\.rules$ {{% elif audit_type == "auditctl" %}} /etc/audit/audit.rules {{% endif %}} {{% if "ol" in families or 'rhel' in product or 'ubuntu' in product %}} {{% set audit_formats = "(?:-F\s+auid>=" ~ uid_min ~ "[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+" %}} {{% else %}} {{% set audit_formats = "" %}} {{% endif %}} ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b{{{ bits }}}[\s]+)(?:.*(-S[\s]+{{{ name }}}[\s]+|([\s]+|[,]){{{ name }}}([\s]+|[,]))).*{{{ audit_formats }}}(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ 1 {{% endmacro %}} {{% for audit_type in ["augenrules", "auditctl" ] %}} {{% for bits in ["32", "64" ] %}} {{{ arkml_oval(audit_type, bits, NAME) }}} {{% endfor %}} {{% endfor %}}