cyberstrikeus CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 - Control 4.1.16
Profile
- Level: 2 - Server
- Level: 2 - Workstation
- Assessment Status: Automated
Description
Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of "modules".
Note: Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.
Rationale
Monitoring the use of insmod, rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.
Impact
None.
Audit Procedure
Command Line
On a 32 bit system:
Run the following command to verify the rules are contained in a .rules file in the /etc/audit/rules.d/ directory:
grep modules /etc/audit/rules.d/*.rules
Verify output matches:
-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules
Run the following command to verify that rules are in the running auditd config:
auditctl -l | grep modules
Verify output matches:
-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module,delete_module -F key=modules
On a 64 bit system:
Run the following command to verify the rules are contained in a .rules file in the /etc/audit/rules.d/ directory:
grep modules /etc/audit/rules.d/*.rules
Verify output matches:
-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules
Run the following command to verify that rules are in the running auditd config:
auditctl -l | grep modules
Verify output matches:
-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module,delete_module -F key=modules
Expected Result
Output should match the rules listed above for the appropriate architecture.
Remediation
Command Line
For 32 bit systems: Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules.
Example: vi /etc/audit/rules.d/50-modules.rules
Add the following lines:
-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules
For 64 bit systems: Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules.
Example: vi /etc/audit/rules.d/50-modules.rules
Add the following lines:
-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules
Default Value
By default, no audit rules are configured for kernel module operations.
References
- CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 - Section 4.1.16
CIS Controls
| Controls Version | Control |
|---|---|
| v7 | 5.1 Establish Secure Configurations - Maintain documented, standard security configuration standards for all authorized operating systems and software. |