All privileged function executions must be audited.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-72095	RHEL-07-030360	SV-86719r3_rule		Medium

Description
Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat.

Description

Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat.

STIG	Date
Red Hat Enterprise Linux 7 Security Technical Implementation Guide	2017-07-08

Details

Check Text ( C-72327r4_chk )
Verify the operating system audits the execution of privileged functions. To find relevant setuid and setgid programs, use the following command once for each local partition [PART]: # find [PART] -xdev -type f \( -perm -4000 -o -perm -2000 \) 2>/dev/null Run the following command to verify entries in the audit rules for all programs found with the previous command: # grep -a always,exit -F -F perm=x -F auid>=1000 -F auid!=4294967295 -k setuid/setgid All "setuid" and "setgid" files on the system must have a corresponding audit rule, or must have an audit rule for the (sub) directory that contains the "setuid"/"setgid" file. If all "setuid"/"setgid" files on the system do not have audit rule coverage, this is a finding.

Check Text ( C-72327r4_chk )

Verify the operating system audits the execution of privileged functions.

To find relevant setuid and setgid programs, use the following command once for each local partition [PART]:

# find [PART] -xdev -type f \( -perm -4000 -o -perm -2000 \) 2>/dev/null

Run the following command to verify entries in the audit rules for all programs found with the previous command:

# grep -a always,exit -F -F perm=x -F auid>=1000 -F auid!=4294967295 -k setuid/setgid

All "setuid" and "setgid" files on the system must have a corresponding audit rule, or must have an audit rule for the (sub) directory that contains the "setuid"/"setgid" file.

If all "setuid"/"setgid" files on the system do not have audit rule coverage, this is a finding.

Fix Text (F-78447r5_fix)
Configure the operating system to audit the execution of privileged functions. To find the relevant "setuid"/"setgid" programs, run the following command for each local partition [PART]: # find [PART] -xdev -type f \( -perm -4000 -o -perm -2000 \) 2>/dev/null For each "setuid"/"setgid" program on the system, which is not covered by an audit rule for a (sub) directory (such as "/usr/sbin"), add a line of the following form to "/etc/audit/audit.rules", where is the full path to each "setuid"/"setgid" program in the list: -a always,exit -F part= -F perm=x -F auid>=1000 -F auid!=4294967295 -k setuid/setgid

Fix Text (F-78447r5_fix)

Configure the operating system to audit the execution of privileged functions.

To find the relevant "setuid"/"setgid" programs, run the following command for each local partition [PART]:

# find [PART] -xdev -type f \( -perm -4000 -o -perm -2000 \) 2>/dev/null

For each "setuid"/"setgid" program on the system, which is not covered by an audit rule for a (sub) directory (such as "/usr/sbin"), add a line of the following form to "/etc/audit/audit.rules", where is the full path to each "setuid"/"setgid" program in the list:

-a always,exit -F part= -F perm=x -F auid>=1000 -F auid!=4294967295 -k setuid/setgid