documentation_complete: true

prodtype: rhel7,fedora

title: 'Ensure <tt>auditd</tt> Collects Information on Exporting to Media (successful)'

description: |-
    At a minimum, the audit system should collect media exportation
    events for all users and root. If the <tt>auditd</tt> daemon is configured to
    use the <tt>augenrules</tt> program to read audit rules during daemon startup
    (the default), add the following line to a file with suffix <tt>.rules</tt> in
    the directory <tt>/etc/audit/rules.d</tt>, setting ARCH to either b32 or b64 as
    appropriate for your system:
    <pre>-a always,exit -F arch=ARCH -S mount -F auid&gt;=1000 -F auid!=4294967295 -F key=export</pre>
    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
    utility to read audit rules during daemon startup, add the following line to
    <tt>/etc/audit/audit.rules</tt> file, setting ARCH to either b32 or b64 as
    appropriate for your system:
    <pre>-a always,exit -F arch=ARCH -S mount -F auid&gt;=1000 -F auid!=4294967295 -F key=export</pre>

rationale: |-
    The unauthorized exportation of data to external media could result in an information leak
    where classified information, Privacy Act information, and intellectual property could be lost. An audit
    trail should be created each time a filesystem is mounted to help identify and guard against information
    loss.

severity: medium

identifiers:
    cce@rhel7: 27447-2

references:
    cis: 5.2.13
    cjis: 5.4.1.1
    cui: 3.1.7
    disa: 135,2884
    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
    nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-3(1),AU-12(a),AU-12(c),IR-5
    pcidss: Req-10.2.7
    srg: SRG-OS-000042-GPOS-00020,SRG-OS-000392-GPOS-00172
    stigid@rhel7: "030740"

ocil_clause: 'there is not output'

ocil: |-
    To verify that auditing is configured for all media exportation events, run the following command:
    <pre>$ sudo auditctl -l | grep syscall | grep mount</pre>
