documentation_complete: true

prodtype: rhel7

title: 'Record Unauthorized Access Attempts to Files (unsuccessful) - open_by_handle_at'

description: |-
    At a minimum, the audit system should collect unauthorized file
    accesses for all users and root. If the <tt>auditd</tt> daemon is configured
    to use the <tt>augenrules</tt> program to read audit rules during daemon
    startup (the default), add the following lines to a file with suffix
    <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
    <pre>-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -F key=access
    -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -F key=access</pre>
    If the system is 64 bit then also add the following lines:
    <pre>
    -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -F key=access
    -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -F key=access</pre>
    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
    utility to read audit rules during daemon startup, add the following lines to
    <tt>/etc/audit/audit.rules</tt> file:
    <pre>-a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -F key=access
    -a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -F key=access</pre>
    If the system is 64 bit then also add the following lines:
    <pre>
    -a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -F key=access
    -a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -F key=access</pre>

rationale: |-
    Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
    these events could serve as evidence of potential system compromise.

severity: medium

identifiers:
    cce@rhel7: 80388-2

references:
    cis: 5.2.10
    cui: 3.1.7
    disa: 172,2884
    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
    nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
    ospp@rhel7: FAU_GEN.1.1.c
    pcidss: Req-10.2.4,Req-10.2.1
    srg: SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205,SRG-OS-000392-GPOS-00172
    stigid@rhel7: "030530"

ocil: '<audit-syscall-check-macro syscall="open_by_handle_at" />'
