SRG-APP-000495-CTR-001235

The container platform must generate audit records when successful/unsuccessful attempts to modify privileges occur.

4 rules found Severity: Medium

3 rules found Severity: Medium

4 rules found Severity: Medium

3 rules found Severity: Medium

4 rules found Severity: Medium

3 rules found Severity: Medium

SRG-APP-000495-CTR-001235

Ensure auditd Collects Information on Exporting to Media (successful)

Record Events that Modify User/Group Information - /etc/group

Record Events that Modify User/Group Information - /etc/gshadow

Record Events that Modify User/Group Information - /etc/security/opasswd

Record Events that Modify User/Group Information - /etc/passwd

Record Events that Modify User/Group Information - /etc/shadow

Record Events that Modify the System's Discretionary Access Controls - chmod

Record Events that Modify the System's Discretionary Access Controls - chown

Record Events that Modify the System's Discretionary Access Controls - fchmod

Record Events that Modify the System's Discretionary Access Controls - fchmodat

Record Events that Modify the System's Discretionary Access Controls - fchown

Record Events that Modify the System's Discretionary Access Controls - fchownat

Record Events that Modify the System's Discretionary Access Controls - fremovexattr

Record Events that Modify the System's Discretionary Access Controls - fsetxattr

Record Events that Modify the System's Discretionary Access Controls - lchown

Record Events that Modify the System's Discretionary Access Controls - lremovexattr

Record Events that Modify the System's Discretionary Access Controls - lsetxattr

Record Events that Modify the System's Discretionary Access Controls - removexattr

Record Events that Modify the System's Discretionary Access Controls - setxattr

Record Events that Modify the System's Discretionary Access Controls - umount

Record Events that Modify the System's Discretionary Access Controls - umount2

Record Any Attempts to Run chacl

Record Any Attempts to Run chcon

Record Any Attempts to Run semanage

Record Any Attempts to Run setfiles

Record Any Attempts to Run setsebool

Ensure auditd Collects File Deletion Events by User - rename

Ensure auditd Collects File Deletion Events by User - renameat

Ensure auditd Collects File Deletion Events by User - rmdir

Ensure auditd Collects File Deletion Events by User - unlink

Ensure auditd Collects File Deletion Events by User - unlinkat

Record Unsuccessful Access Attempts to Files - creat

Record Unsuccessful Access Attempts to Files - ftruncate

Record Unsuccessful Access Attempts to Files - open

Record Unsuccessful Access Attempts to Files - open_by_handle_at

Record Unsuccessful Access Attempts to Files - openat

Record Unsuccessful Access Attempts to Files - truncate

Ensure auditd Collects Information on Kernel Module Unloading - delete_module

Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module

Ensure auditd Collects Information on Kernel Module Loading - init_module

Record Attempts to Alter Logon and Logout Events - lastlog

Ensure auditd Collects Information on the Use of Privileged Commands - chage

Ensure auditd Collects Information on the Use of Privileged Commands - chsh

Ensure auditd Collects Information on the Use of Privileged Commands - crontab

Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd

Ensure auditd Collects Information on the Use of Privileged Commands - kmod

Ensure auditd Collects Information on the Use of Privileged Commands - newgrp

Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check

Ensure auditd Collects Information on the Use of Privileged Commands - passwd

Ensure auditd Collects Information on the Use of Privileged Commands - postdrop

Ensure auditd Collects Information on the Use of Privileged Commands - postqueue

Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign

Ensure auditd Collects Information on the Use of Privileged Commands - su

Ensure auditd Collects Information on the Use of Privileged Commands - sudo

Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit

Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd

Ensure auditd Collects Information on the Use of Privileged Commands - userhelper

Ensure auditd Collects Information on the Use of Privileged Commands - usermod