mediumfilesystemverified ✓

Ensure the file integrity tool verifies extended attributes

aide-xattr-check · RHEL ≥ 8 · 1 impl

Description

The AIDE file integrity tool must be configured to verify extended attributes (xattrs) on monitored files and directories.

Rationale

Extended attributes include SELinux security labels. Without extended attribute verification, an attacker could modify SELinux labels or other security-relevant xattrs without triggering AIDE alerts, potentially undermining mandatory access control enforcement.

Check → Remediate

Checkcommand

# Check if AIDE is configured with xattrs option
if grep -qiE 'xattr|xattrs' /etc/aide.conf /etc/aide.d/*.conf 2>/dev/null; then
  echo "OK: AIDE is configured to verify extended attributes"
  exit 0
fi
echo "FAIL: AIDE is not configured to verify extended attributes"
exit 1

expected_exit:: 0

Remediatemanual

note:: Add 'xattrs' to the AIDE check groups in /etc/aide.conf. For example, add to your NORMAL or PERMS rule set: PERMS = p+i+u+g+acl+xattrs+sha256 Then reinitialize the AIDE database: aide --init

Framework references

STIG

V-280982 / RHEL-10-200635V-258139 / RHEL-09-651035V-230551

NIST 800-53

AU-7CM-3SI-7

Live verification

rhel8:checkrhel9:check

#aide#file-integrity#xattr#selinux#security