documentation_complete: true

prodtype: rhel7

title: 'Ensure <tt>auditd</tt> Collects Information on Kernel Module Unloading - rmmod'

description: |-
    To capture invocation of rmmod, utility used to remove modules from kernel,
    add the following line:
    <pre>-w /usr/sbin/rmmod -p x -k modules</pre>
    Place to add the line depends on a way <tt>auditd</tt> daemon is configured. If it is configured
    to use the <tt>augenrules</tt> program (the default), add the line to a file with suffix
    <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>.

    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt> utility,
    add the line to file <tt>/etc/audit/audit.rules</tt>.

rationale: |-
    The removal of kernel modules can be used to alter the behavior of
    the kernel and potentially introduce malicious code into kernel space. It is important
    to have an audit trail of modules that have been introduced into the kernel.

severity: medium

identifiers:
    cce@rhel7: 80416-1

references:
    cis: 5.2.17
    cui: 3.1.7
    disa: 172
    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
    nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
    ospp@rhel7: FAU_GEN.1.1.c
    pcidss: Req-10.2.7
    srg: SRG-OS-000471-GPOS-00216,SRG-OS-000477-GPOS-00222
    stigid@rhel7: "030850"

ocil_clause: 'there is not output'

ocil: |-
    To verify that auditing is configured for system administrator actions, run the following command:
    <pre>$ sudo auditctl -l | grep "watch=/usr/sbin/rmmod"</pre>
