mediumauditverified ✓✓rollback-safe
Audit kernel module loads (Ubuntu)
audit-syscall-module-load · UBUNTU ≥ 22 · 1 impl
Description
The system must generate an audit record for kernel module loads so that the responsible user can be identified.
Rationale
Auditing these system calls supports detection of unauthorized changes and forensic reconstruction of events.
Check → Remediate
Checkaudit_rule_exists
- rule:
- -a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng
Remediateaudit_rule_set
- rule:
- -a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng
- persist_file:
- /etc/audit/rules.d/50-syscall-module-load.rules
Framework references
STIG
V-270805 / UBTU-24-900340V-260637 / UBTU-22-654175
NIST 800-53
AU-2AU-12
Live verification
ubuntu22:checkubuntu24:checkubuntu24:remediate
#audit#auditd#syscall