documentation_complete: true

title: 'Ensure <tt>auditd</tt> Collects Information on Exporting to Media (successful)'

description: |-
    At a minimum the audit system should collect media
    exportation events for all users and root. Add the following to
    <tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as
    appropriate for your system:
    <pre>-a always,exit -F arch=ARCH -S mount -F auid&gt;=500 -F auid!=4294967295 -k export</pre>

rationale: |-
    The unauthorized exportation of data to external media could result in an information leak
    where classified information, Privacy Act information, and intellectual property could be lost. An audit
    trail should be created each time a filesystem is mounted to help identify and guard against information
    loss.

severity: unknown

identifiers:
    cce: 26573-6

references:
    disa: 126
    nist: AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
    pcidss: Req-10.2.7
    srg: SRG-OS-000064
    stigid: RHEL-06-000199

ocil_clause: 'there is not output'

ocil: |-
    To verify that auditing is configured for all media exportation events, run the following command:
    <pre>$ sudo auditctl -l | grep syscall | grep mount</pre>
