documentation_complete: true

title: 'Ensure <tt>auditd</tt> Collects Information on the Use of Privileged Commands'

description: |-
    At a minimum, the audit system should collect the execution of
    privileged commands for all users and root. To find the relevant setuid /
    setgid programs, run the following command for each local partition
    <i>PART</i>:
    <pre>$ sudo find <i>PART</i> -xdev -type f -perm -4000 -o -type f -perm -2000 2&gt;/dev/null</pre>
    If the <tt>auditd</tt> daemon is configured to use the <tt>augenrules</tt>
    program to read audit rules during daemon startup (the default), add a line of
    the following form to a file with suffix <tt>.rules</tt> in the directory
    <tt>/etc/audit/rules.d</tt> for each setuid / setgid program on the system,
    replacing the <i>SETUID_PROG_PATH</i> part with the full path of that setuid /
    setgid program in the list:
    <pre>-a always,exit -F path=<i>SETUID_PROG_PATH</i> -F perm=x -F auid&gt;=1000 -F auid!=4294967295 -F key=privileged</pre>
    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
    utility to read audit rules during daemon startup, add a line of the following
    form to <tt>/etc/audit/audit.rules</tt> for each setuid / setgid program on the
    system, replacing the <i>SETUID_PROG_PATH</i> part with the full path of that
    setuid / setgid program in the list:
    <pre>-a always,exit -F path=<i>SETUID_PROG_PATH</i> -F perm=x -F auid&gt;=1000 -F auid!=4294967295 -F key=privileged</pre>

rationale: |-
    Misuse of privileged functions, either intentionally or unintentionally by
    authorized users, or by unauthorized external entities that have compromised system accounts,
    is a serious and ongoing concern and can have significant adverse impacts on organizations.
    Auditing the use of privileged functions is one way to detect such misuse and identify
    the risk from insider and advanced persistent threast.
    <br /><br />
    Privileged programs are subject to escalation-of-privilege attacks,
    which attempt to subvert their normal role of providing some necessary but
    limited capability. As such, motivation exists to monitor these programs for
    unusual activity.

severity: medium

identifiers:
    cce@rhel7: 27437-3

references:
    cis: 5.2.10
    cjis: 5.4.1.1
    cui: 3.1.7
    disa: 2234
    nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-2(4),AU-6(9),AU-12(a),AU-12(c),IR-5
    pcidss: Req-10.2.2
    srg: SRG-OS-000327-GPOS-00127
    stigid@rhel7: "030360"

ocil_clause: 'it is not the case'

ocil: |-
    To verify that auditing of privileged command use is configured, run the
    following command for each local partition <i>PART</i> to find relevant
    setuid / setgid programs:
    <pre>$ sudo find <i>PART</i> -xdev -type f -perm -4000 -o -type f -perm -2000 2&gt;/dev/null</pre>
    Run the following command to verify entries in the audit rules for all programs
    found with the previous command:
    <pre>$ sudo grep path /etc/audit/audit.rules</pre>
    It should be the case that all relevant setuid / setgid programs have a line
    in the audit rules.
