mediumauditunverified
Audit unlink/unlinkat file-deletion syscalls (RHEL 10)
audit-file-deletion-unlink-rhel10 · RHEL ≥ 10 · 1 impl
Description
On RHEL 10 record file-deletion via the unlink and unlinkat syscalls by interactive users (both ABIs), keyed 'delete'.
Rationale
Auditing deletions supports forensic reconstruction and detection of tampering or anti-forensic activity.
Check → Remediate
Checkcomposed · 2 sub-checks (all must pass)
- 1. audit_rule_exists:
- rule=-a always,exit -F arch=b64 -S unlink,unlinkat -F auid>=1000 -F auid!=unset -k delete
- 2. audit_rule_exists:
- rule=-a always,exit -F arch=b32 -S unlink,unlinkat -F auid>=1000 -F auid!=unset -k delete
Remediatemanual
- note:
- Add -S unlink,unlinkat (b64+b32, auid>=1000, -k delete) audit rules to /etc/audit/rules.d/ and augenrules --load.
Framework references
CIS
rhel10 6.3.3.24
NIST 800-53
AU-12
#audit#delete#unlink#cis