cyberstrikeus CIS Ubuntu 20.04 LTS Benchmark v3.0.0 - 6.3.3.19
Control: Ensure kernel module loading unloading and modification is collected
Profile Applicability: Level 2 - Server, Level 2 - Workstation
Description: Monitor the loading and unloading of kernel modules. All the loading / listing / dependency checking of modules is done by kmod via symbolic links.
The following system calls control loading and unloading of modules:
- init_module - load a module
- finit_module - load a module (used when the overhead of using cryptographically signed modules to determine the authenticity of a module can be avoided)
- delete_module - delete a module
- create_module - create a loadable module entry
- query_module - query the kernel for various bits pertaining to modules
Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of modules.
Rationale: Monitoring the use of all the various ways to manipulate kernel modules could provide system administrators with evidence that an unauthorized change was made to a kernel module, possibly compromising the security of the system.
Audit
On disk configuration
Run the following script to check the on disk rules:
#!/usr/bin/env bash
{
awk '/^ *-a *always,exit/ \
&&/ -F *arch=b64/ \
&&(/ -F auid!=unset/||/ -F auid!=-1/||/ -F auid!=4294967295/) \
&&/ -S/ \
&&/init_module/ \
&&(/init_module/ \
||/delete_module/ \
||/create_module/ \
||/query_module/) \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)' /etc/audit/rules.d/*.rules
UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
[ -n "${UID_MIN}" ] || UID_MIN=1000
awk "/^ *-a *always,exit/ \
&&/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \
&&/ -F *auid>=${UID_MIN}/ \
&&/ -F *perm=x/ \
&&/ -F *path=\/usr\/bin\/kmod/ \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)" /etc/audit/rules.d/*.rules \
|| printf "ERROR: Variable 'UID_MIN' is unset.\n"
}
Verify the output matches:
-a always,exit -F arch=b64 -S init_module,finit_module,delete_module,create_module,query_module -F auid>=1000 -F auid!=unset -k kernel_modules
-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k kernel_modules
Running configuration
Run the following script to check loaded rules:
#!/usr/bin/env bash
{
auditctl -l | awk '/^ *-a *always,exit/ \
&&/ -F *arch=b64/ \
&&(/ -F auid!=unset/||/ -F auid!=-1/||/ -F auid!=4294967295/) \
&&/ -S/ \
&&/init_module/ \
&&(/init_module/ \
||/finit_module/ \
||/delete_module/ \
||/create_module/ \
||/query_module/) \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'
UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
[ -n "${UID_MIN}" ] || auditctl -l | awk "/^ *-a *always,exit/ \
&&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \
&&/ -F *auid>=${UID_MIN}/ \
&&/ -F *perm=x/ \
&&/ -F *path=\/usr\/bin\/kmod/ \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)" \
|| printf "ERROR: Variable 'UID_MIN' is unset.\n"
}
Verify the output includes:
-a always,exit -F arch=b64 -S create_module,init_module,delete_module,query_module,finit_module -F auid>=1000 -F auid!=-1 -F key=kernel_modules
-a always,exit -S all -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=-1 -F key=kernel_modules
Symlink audit
Run the following script to audit if the kmod symlinks accepts are indeed pointing at it:
#!/usr/bin/env bash
{
a_files=("/usr/sbin/lsmod" "/usr/sbin/rmmod" "/usr/sbin/insmod" "/usr/sbin/modinfo" "/usr/sbin/modprobe" "/usr/sbin/depmod")
for i_file in "${a_files[@]}"; do
if [ "$(readlink -f "$i_file")" = "$(readlink -f /bin/kmod)" ]; then
printf "OK: \"${i_file}\"\n"
else
printf "Issue with symlink for file: \"${i_file}\"\n"
fi
done
}
Verify the output states OK. If there is a symlink pointing to a different location it should be investigated.
Remediation
Create audit rules by editing or creating a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor kernel module modification.
Example:
#!/usr/bin/env bash
{
UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
[ -n "${UID_MIN}" ] && printf "
-a always,exit -F arch=b64 -S init_module,finit_module,delete_module,create_module,query_module -F auid>=${UID_MIN} -F auid!=unset -k kernel_modules
-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k kernel_modules
" >> /etc/audit/rules.d/50-kernel_modules.rules || printf "ERROR: Variable 'UID_MIN' is unset.\n"
}
Load audit rules:
augenrules --load
Check if reboot is required:
if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi
Additional Information:
Potential reboot required - If the auditing configuration is locked (-e 2), then augenrules will not warn in any way that rules could not be loaded into the running configuration. A system reboot will be required to load the rules into the running configuration.
System call structure - For performance (man 7 audit.rules) reasons it is preferable to have all the system calls on one line. However, your configuration may have them on one line each or some other combination. This is important to understand for both the auditing and remediation sections as the examples given are optimized for performance as per the man page.
CIS Controls:
- v8: 8.5 Collect Detailed Audit Logs - Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation.
- v7: 6.2 Activate audit logging - Ensure that local logging has been enabled on all systems and networking devices.
MITRE ATT&CK Mappings:
- Techniques: T1562, T1562.006
- Tactics: TA0004
- Mitigations: M1047
References:
- NIST SP 800-53 Rev. 5: AU-3, CM-6
- STIG ID: UBTU-20-010296 | RULE ID: SV-238318r991586 | CAT II
- STIG ID: UBTU-22-654060 | RULE ID: SV-260614r991586 | CAT II