The Photon operating system must initiate auditing as part of the boot process.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-256521	PHTN-30-000046	SV-256521r887237_rule		Medium

Description
Each process on the system carries an "auditable" flag, which indicates whether its activities can be audited. Although auditd takes care of enabling this for all processes that launch after it starts, adding the kernel argument ensures the flag is set at boot for every process on the system. This includes processes created before auditd starts.

STIG	Date
VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide	2023-02-21

Details

Check Text ( C-60196r887235_chk )
At the command line, run the following command: # grep "audit=1" /proc/cmdline If no results are returned, this is a finding.

Fix Text (F-60139r887236_fix)
Navigate to and open: /boot/grub2/grub.cfg Locate the boot command line arguments. An example follows: linux /$photon_linux root=$rootpartition $photon_cmdline $systemd_cmdline Add "audit=1" to the end of the line so it reads as follows: linux /$photon_linux root=$rootpartition $photon_cmdline $systemd_cmdline audit=1 Note: Do not copy/paste in this example argument line. This may change in future releases. Find the similar line and append "audit=1" to it. Reboot the system for the change to take effect.

Fix Text (F-60139r887236_fix)

Navigate to and open:

/boot/grub2/grub.cfg

Locate the boot command line arguments. An example follows:

linux /$photon_linux root=$rootpartition $photon_cmdline $systemd_cmdline

Add "audit=1" to the end of the line so it reads as follows:

linux /$photon_linux root=$rootpartition $photon_cmdline $systemd_cmdline audit=1

Note: Do not copy/paste in this example argument line. This may change in future releases. Find the similar line and append "audit=1" to it.

Reboot the system for the change to take effect.