documentation_complete: true

prodtype: rhel7,fedora

title: 'Make the <tt>auditd</tt> Configuration Immutable'

description: |-
    If the <tt>auditd</tt> daemon is configured to use the
    <tt>augenrules</tt> program to read audit rules during daemon startup (the
    default), add the following line to a file with suffix <tt>.rules</tt> in the
    directory <tt>/etc/audit/rules.d</tt> in order to make the auditd configuration
    immutable:
    <pre>-e 2</pre>
    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
    utility to read audit rules during daemon startup, add the following line to
    <tt>/etc/audit/audit.rules</tt> file in order to make the auditd configuration
    immutable:
    <pre>-e 2</pre>
    With this setting, a reboot will be required to change any audit rules.

rationale: |-
    Making the audit configuration immutable prevents accidental as
    well as malicious modification of the audit rules, although it may be
    problematic if legitimate changes are needed during system
    operation

severity: medium

identifiers:
    cce@rhel7: 27097-5

references:
    cis: 4.1.18
    cjis: 5.4.1.1
    cui: 3.3.1,3.4.3
    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.310(a)(2)(iv),164.312(d),164.310(d)(2)(iii),164.312(b),164.312(e)
    nist: AC-6,AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5
    pcidss: Req-10.5.2
