Confirm Nutanix AOS generates audit records on all successful/unsuccessful attempts to access privileges occur.
$ sudo grep -iw open /etc/audit/audit.rules
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid=0 -k access.
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid=0 -k access.
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access.
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access.
-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid=0 -k access.
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid=0 -k access.
-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access.
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access.
If the output does not contain all of the above rules, this is a finding.
If both the "b32" and "b64" audit rules are not defined for the listed syscall(s), this is a finding.
$ sudo grep -iw openat /etc/audit/audit.rules
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid=0 -k access.
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid=0 -k access.
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access.
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access.
-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid=0 -k access.
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid=0 -k access.
-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access.
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access.
If the output does not contain all of the above rules, this is a finding.
If both the "b32" and "b64" audit rules are not defined for the listed syscall(s), this is a finding.
$ sudo grep -iw open_by_handle_at /etc/audit/audit.rules
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid=0 -k access.
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid=0 -k access.
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access.
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access.
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid=0 -k access.
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid=0 -k access.
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access.
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access.
If the output does not contain all of the above rules, this is a finding.
If both the "b32" and "b64" audit rules are not defined for the listed syscall(s), this is a finding.