mediumauditunverified
Audit kernel-module delete_module unload (RHEL 10)
audit-module-delete-rhel10 · RHEL ≥ 10 · 1 impl
Description
On RHEL 10 the kernel-module audit controls are split per syscall and keyed 'kernel_modules'. Record use of the delete_module syscall(s) by interactive users.
Rationale
Loading, unloading, or querying kernel modules can alter kernel behavior or attack surface; auditing provides attribution.
Check → Remediate
Checkaudit_rule_exists
- rule:
- -a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset
Remediatemanual
- note:
- Add -S delete_module (b64, auid>=1000, -k kernel_modules) audit rule to /etc/audit/rules.d/ and augenrules --load.
Framework references
CIS
rhel10 6.3.3.33
STIG
V-281126 / RHEL-10-500400
NIST 800-53
AU-12
#audit#kernel-modules#cis