SV-274167r1120489: Amazon Linux 2023 must enable auditing of processes that start prior to the audit daemon. | Amazon Linux 2023 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

Amazon Linux 2023 must enable auditing of processes that start prior to the audit daemon.

Description

Discussion Text

Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. If auditing is enabled late in the startup process, the actions of some startup processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000473-GPOS-00218, SRG-OS-000254-GPOS-00095

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000130Not mappedCCI-000135Not mappedCCI-000169Not mappedCCI-002884Not mappedCCI-000172Not mappedCCI-001464

References

DPMS Target Amazon Linux 2023 DISA DPMS Target Amazon Linux 2023 5700

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.amzlx23os:def:274167
# Amazon Linux 2023 must enable auditing of processes that start prior to the audit daemon.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# textfilecontent54_object (textfilecontent54_test)
test_1() {
  (grep -rhP --include='*.conf' '^options\s+(.*)$' '/boot/loader/entries' | sed -En 's/^options\s+(.*)$/\1/p') | grep -Pq '(^|\s)audit=1(\s|$)'
}
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  (sed -En 's/^GRUB_CMDLINE_LINUX="(.*)"/\1/p' '/etc/default/grub') | grep -Pq '(^|\s)audit=1(\s|$)'
}

if ( test_1 && test_2 ); then
  echo "PASS"
else
  echo "FAIL"
fi

Remediation

Configure Amazon Linux 2023 so that GRUB 2 enables auditing of processes that start prior to the audit daemon with the following command:

$ sudo grubby --update-kernel=ALL --args="audit=1"

Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates:

GRUB_CMDLINE_LINUX="audit=1"