CME-1002

Audit Subsystem (auditd)

Detect OS/Kernel Unquantified evidence Detective

Description

Linux kernel audit framework that logs syscalls, file access, authentication events, and security-relevant operations. Provides forensic trail and can trigger alerts.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	Compensating control: attacker actions are logged and may trigger alerting

CWE Relationships

CWE-778

Verification

Verify auditd is running with rules loaded

$ auditctl -s | grep enabled
# Expected: enabled 1

Platform: linux

$ auditctl -l | wc -l
# Expected: Non-zero rule count

Platform: linux

Remediation

linux Enable auditd with base security audit rules


systemctl enable --now auditd
cat > /etc/audit/rules.d/99-cme-1002.rules <<'EOF'
## Sensitive file access
-w /etc/shadow -p wa -k shadow_access
-w /etc/passwd -p wa -k passwd_access
-w /etc/sudoers -p wa -k sudoers_access
-w /etc/sudoers.d/ -p wa -k sudoers_access

## Privileged command execution
-a always,exit -F arch=b64 -S execve -F euid=0 -F auid>=1000 -F auid!=unset -k priv_exec
-a always,exit -F arch=b32 -S execve -F euid=0 -F auid>=1000 -F auid!=unset -k priv_exec

## Kernel module loading
-w /sbin/insmod -p x -k module_load
-w /sbin/modprobe -p x -k module_load
-w /sbin/rmmod -p x -k module_load
-a always,exit -F arch=b64 -S init_module,finit_module,delete_module -k module_load
EOF
augenrules --load

References