RHEL 9 audit system must protect logon UIDs from unauthorized change.
An XCCDF Rule
Description
If modification of login user identifiers (UIDs) is not prevented, they can be changed by nonprivileged users and make auditing complicated or impossible. Satisfies: SRG-OS-000462-GPOS-00206, SRG-OS-000475-GPOS-00220, SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029
- ID
- SV-258228r991572_rule
- Version
- RHEL-09-654270
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure RHEL 9 auditing to prevent modification of login UIDs once they are set by adding the following line to /etc/audit/rules.d/audit.rules:
--loginuid-immutable
The audit daemon must be restarted for the changes to take effect.