Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-22383 | GEN002825 | SV-26525r1_rule | ECAR-1 | Medium |
Description |
---|
Actions concerning dynamic kernel modules must be recorded as they are substantial events. Dynamic kernel modules can increase the attack surface of a system. A malicious kernel module can be used to substantially alter the functioning of a system, often with the purpose of hiding a compromise from the SA. |
STIG | Date |
---|---|
HP-UX 11.23 Security Technical Implementation Guide | 2012-05-25 |
Check Text ( C-36447r1_chk ) |
---|
Check /etc/audit/audit_site.conf file to determine if syscalls handling kernel modules are audited. # egrep -i "modadm|modload|moduload|modpath" /etc/audit/audit_site.conf All of the above syscalls must be defined in the file, otherwise this is a finding. |
Fix Text (F-31786r1_fix) |
---|
Edit /etc/audit/audit_site.conf and add the modload, moduload, and modpath syscalls to the list of events to be audited. |