The audit system must be configured to audit the loading and unloading of dynamic kernel modules.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-22383 | GEN002825 | SV-26525r2_rule | ECAR-1 | Medium |
| Description |
|---|
| Actions concerning dynamic kernel modules must be recorded as they are substantial events. Dynamic kernel modules can increase the attack surface of a system. A malicious kernel module can be used to substantially alter the functioning of a system, often with the purpose of hiding a compromise from the SA. |
| STIG | Date |
|---|---|
| HP-UX 11.23 Security Technical Implementation Guide | 2015-12-02 |
Details
| Check Text ( C-36447r2_chk ) |
|---|
| Check /etc/audit/audit_site.conf file to determine if syscalls handling kernel modules are audited. # egrep -i "admin|modload|moduload|modpath" /etc/audit/audit_site.conf All of the above syscalls must be defined in the file, otherwise this is a finding. |
| Fix Text (F-31786r2_fix) |
|---|
| Edit /etc/audit/audit_site.conf and add the admin, modload, moduload, and modpath syscalls to the list of events to be audited. |