documentation_complete: true

prodtype: rhel7,fedora

title: 'Enable Auditing for Processes Which Start Prior to the Audit Daemon'

description: |-
    To ensure all processes can be audited, even those which start
    prior to the audit daemon, add the argument <tt>audit=1</tt> to the default
    GRUB 2 command line for the Linux operating system in
    <tt>/etc/default/grub</tt>, in the manner below:
    <pre>GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=VolGroup/LogVol06 rd.lvm.lv=VolGroup/lv_swap rhgb quiet rd.shell=0 audit=1"</pre>

rationale: |-
    Each process on the system carries an "auditable" flag which indicates whether
    its activities can be audited. Although <tt>auditd</tt> takes care of enabling
    this for all processes which launch after it does, adding the kernel argument
    ensures it is set for every process during boot.

severity: medium

identifiers:
    cce@rhel7: 27212-0

references:
    cis: 4.1.3
    cjis: 5.4.1.1
    cui: 3.3.1
    disa: 1464,130
    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(5)(ii)(C),164.310(a)(2)(iv),164.310(d)(2)(iii),164.312(b)
    nist: AC-17(1),AU-14(1),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-10,IR-5
    pcidss: Req-10.3

ocil_clause: 'auditing is not enabled at boot time'

ocil: |-
    Inspect the form of default GRUB 2 command line for the Linux operating system
    in <tt>/etc/default/grub</tt>. If they include <tt>audit=1</tt>, then auditing
    is enabled at boot time.
    <br /><br />
    To ensure <tt>audit=1</tt> is configured on all installed kernels, the
    following command may be used:
    <br />
    <pre>$ sudo /sbin/grubby --update-kernel=ALL --args="audit=1"</pre>
    <br />
