By default, SUSE Linux Enterprise 12 ships an audit rule to disable syscall
auditing for performance reasons.
To make sure that syscall auditing works, this line must be removed from
/etc/audit/rules.d/audit.rules and /etc/audit/audit.rules:
-a task,never
Rationale
Audit rules for syscalls do not take effect unless this line is removed.
# Remediation is applicable only in certain platforms
if rpm --quiet -q audit && rpm --quiet -q kernel-default; then
if [ -f "/usr/lib/systemd/system/auditd.service" ] ; then
IS_AUGENRULES=$(grep -E "^(ExecStartPost=|Requires=augenrules\.service)" /usr/lib/systemd/system/auditd.service)
if [[ "$IS_AUGENRULES" == *"augenrules"* ]] ; then
for f in /etc/audit/rules.d/*.rules ; do
sed -E -i --follow-symlinks 's/^(\s*-a\s+task,never)/#\1/' "$f"
done
else
# auditctl is used
sed -E -i --follow-symlinks 's/^(\s*-a\s+task,never)/#\1/' /etc/audit/audit.rules
fi
systemctl is-active --quiet auditd.service
if [ $? -ne 0 ] ; then
systemctl restart auditd.service
fi
fi
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi
Remediation - Ansible
- name: Gather the package facts
package_facts:
manager: auto
tags:
- CCE-83119-8
- DISA-STIG-SLES-12-020199