SRG-APP-000502-CTR-001270

The container platform must generate audit records when successful/unsuccessful attempts to delete categories of information (e.g., classification levels) occur.

Details
Associations

29 rules found Severity: Medium

28 rules found Severity: Medium

29 rules found Severity: Medium

18 rules found Severity: Medium

13 rules found Severity: Medium

12 rules found Severity: Medium

17 rules found Severity: Medium

9 rules found Severity: Medium

7 rules found Severity: Medium

SRG-APP-000502-CTR-001270

Record Events that Modify the System's Discretionary Access Controls - fsetxattr

Record Events that Modify the System's Discretionary Access Controls - lremovexattr

Record Events that Modify the System's Discretionary Access Controls - lsetxattr

Record Events that Modify the System's Discretionary Access Controls - removexattr

Ensure auditd Collects File Deletion Events by User - rename

Ensure auditd Collects File Deletion Events by User - renameat

Ensure auditd Collects File Deletion Events by User - rmdir

Ensure auditd Collects File Deletion Events by User - unlink

Ensure auditd Collects File Deletion Events by User - unlinkat

Record Any Attempts to Run chcon

Record Unsuccessful Delete Attempts to Files - rename

Record Unsuccessful Delete Attempts to Files - renameat

Record Unsuccessful Delete Attempts to Files - unlink

Record Unsuccessful Delete Attempts to Files - unlinkat

Ensure auditd Collects Information on the Use of Privileged Commands - chage

Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown

Configure auditing of unsuccessful file deletions