Define a complete security baseline and monitor the baseline's rules. The definition of the baseline should be done in Hiera. The purpose of the module is to give the ability to setup a complete security baseline which not necessarily have to stick to industry security guides like the CIS benchmarks.
Apache License 2.0
15
stars
10
forks
source link
auditd - Collects Information on the Use of Privileged Commands - kmod #66
I am getting a failed on this rule. -a always,exit -S all -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=4294967295 -F key=kernel_modules
CIS RHEL8 Benchmark v2.0.0 page 436 -a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k kernel_modules