Ensure kernel module loading and unloading is collected

DüşükDüzey 2Otomatiklinux

Açıklama

Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of "modules". Note: Reloading the auditd config to set active settings requi

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep modules /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /sbin/insmod -p x -k modules' || { echo step1: missing '-w /sbin/insmod -p x -k modules'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /sbin/rmmod -p x -k modules' || { echo step1: missing '-w /sbin/rmmod -p x -k modules'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /sbin/modprobe -p x -k modules' || { echo step1: missing '-w /sbin/modprobe -p x -k modules'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b32 -S init_module -S delete_module -k modules' || { echo step1: missing '-a always,exit -F arch=b32 -S init_module -S delete_module -'; return 1; }; command -v auditctl >/dev/null 2>&1 || { echo "step2: auditctl not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'auditctl -l | grep modules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /sbin/insmod -p x -k modules' || { echo step2: missing '-w /sbin/insmod -p x -k modules'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /sbin/rmmod -p x -k modules' || { echo step2: missing '-w /sbin/rmmod -p x -k modules'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /sbin/modprobe -p x -k modules' || { echo step2: missing '-w /sbin/modprobe -p x -k modules'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b32 -S init_module,delete_module -F key=modules On a 64 bit system run the following commands:' || { echo step2: missing '-a always,exit -F arch=b32 -S init_module,delete_module -F k'; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step3: grep not installed"; return 1; }; o=$(bash -c 'grep modules /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/modules.rules:-w /sbin/insmod -p x -k modules' || { echo step3: missing '/etc/audit/rules.d/modules.rules:-w /sbin/insmod -p x -k mod'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/modules.rules:-w /sbin/rmmod -p x -k modules' || { echo step3: missing '/etc/audit/rules.d/modules.rules:-w /sbin/rmmod -p x -k modu'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/modules.rules:-w /sbin/modprobe -p x -k modules' || { echo step3: missing '/etc/audit/rules.d/modules.rules:-w /sbin/modprobe -p x -k m'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/modules.rules:-a always,exit -F arch=b64 -S init_module -S delete_module -k' || { echo step3: missing '/etc/audit/rules.d/modules.rules:-a always,exit -F arch=b64 '; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- modules || { echo step3: missing modules; return 1; }; command -v auditctl >/dev/null 2>&1 || { echo "step4: auditctl not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step4: grep not installed"; return 1; }; o=$(bash -c 'auditctl -l | grep modules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /sbin/insmod -p x -k modules' || { echo step4: missing '-w /sbin/insmod -p x -k modules'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /sbin/rmmod -p x -k modules' || { echo step4: missing '-w /sbin/rmmod -p x -k modules'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /sbin/modprobe -p x -k modules' || { echo step4: missing '-w /sbin/modprobe -p x -k modules'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b64 -S init_module,delete_module -F key=modules' || { echo step4: missing '-a always,exit -F arch=b64 -S init_module,delete_module -F k'; return 1; }; }; if alt0; then echo compliant; fi

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules Example: vi /etc/audit/rules.d/modules.rules and add the following lines: -w /sbin/insmod -p x -k modules -w /sbin/rmmod -p x -k modules -w /sbin/modprobe -p x -k modules -a always,exit -F arch=b32 -S init_module -S delete_module -k modules For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules Example: vi /etc/audit/rules.d/modules.rules and add the following lines: -w /sbin/insmod -p x -k modules -w /sbin/rmmod -p x -k modules -w /sbin/modprobe -p x -k modules -a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Özellikler

İşletim sistemleri: sles-12
Etiketler: cis-convertedlinux
Referans: CIS SUSE Linux Enterprise 12 Benchmark v3.2.0 - 4.1.16

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target linux --level 2