The audit system must be configured to audit the loading and unloading of dynamic kernel modules.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22383	GEN002825	SV-26524r1_rule	ECAR-1	Medium

Description
Actions concerning dynamic kernel modules must be recorded as they are substantial events. Dynamic kernel modules can increase the attack surface of a system. A malicious kernel module can be used to substantially alter the functioning of a system, often with the purpose of hiding a compromise from the SA.

STIG	Date
SOLARIS 9 X86 SECURITY TECHNICAL IMPLEMENTATION GUIDE	2015-10-01

Details

Check Text ( C-27577r1_chk )
Check /etc/security/audit_control file. # grep flags /etc/security/audit_control If the as element is missing from the flags line, this is a finding.

Fix Text (F-23766r1_fix)
Edit /etc/security/audit_control and add the as flag to the flag parameter.