Skip to content

Enable Auditing to Start Prior to the Audit Daemon in zIPL

An XCCDF Rule

Description

To ensure all processes can be audited, even those which start prior to the audit daemon, check that all boot entries in /boot/loader/entries/*.conf have audit=1 included in its options.
To ensure that new kernels and boot entries continue to enable audit, add audit=1 to /etc/kernel/cmdline.

Rationale

Each process on the system carries an "auditable" flag which indicates whether its activities can be audited. Although auditd takes care of enabling this for all processes which launch after it does, adding the kernel argument ensures it is set for every process during boot.

ID
xccdf_org.ssgproject.content_rule_zipl_audit_argument
Severity
Medium
References
Updated