| To determine if the system is configured to audit calls to the "removexattr" system call, run the following command: |
# auditctl -l | grep syscall | grep removexattr
If the system is configured to audit this activity, it will return several lines, such as:
LIST_RULES: exit,always arch=3221225534 (0xc000003e) syscall=lchown,sethostname,init_module,delete_module,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr,clock_settime
If no lines are returned, this is a finding.