mediumauditverified ✓✓rollback-safe
Audit kernel module unloads (Ubuntu)
audit-syscall-module-unload · UBUNTU ≥ 22 · 1 impl
Description
The system must generate an audit record for kernel module unloads so that the responsible user can be identified.
Rationale
Auditing these system calls supports detection of unauthorized changes and forensic reconstruction of events.
Check → Remediate
Checkaudit_rule_exists
- rule:
- -a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng
Remediateaudit_rule_set
- rule:
- -a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng -a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng
- persist_file:
- /etc/audit/rules.d/50-syscall-module-unload.rules
Framework references
STIG
V-270806 / UBTU-24-900350V-260636 / UBTU-22-654170
NIST 800-53
AU-2AU-12
Live verification
ubuntu22:checkubuntu24:checkubuntu24:remediate
#audit#auditd#syscall