Enable Auditing to Start Prior to the Audit Daemon in zIPL
An XCCDF Rule
Description
To ensure all processes can be audited, even those which start prior to the audit daemon,
check that all boot entries in /boot/loader/entries/*.conf
have audit=1
included in its options.
To ensure that new kernels and boot entries continue to enable audit,
add audit=1
to /etc/kernel/cmdline
.
Rationale
Each process on the system carries an "auditable" flag which indicates whether
its activities can be audited. Although auditd
takes care of enabling
this for all processes which launch after it does, adding the kernel argument
ensures it is set for every process during boot.
- ID
- xccdf_org.ssgproject.content_rule_zipl_audit_argument
- Severity
- Medium
- Updated