Successful/unsuccessful uses of the reboot command in RHEL 9 must generate an audit record.

STIG ID: RHEL-09-654195  |  SRG: SRG-OS-000477-GPOS-00222 |  Severity: medium |  CCI: CCI-000172 |  Vulnerability Id: V-258213 | 

Vulnerability Discussion

Misuse of the reboot command may cause availability issues for the system.

Check

Verify that RHEL 9 is configured to audit the execution of the "reboot" command with the following command:

$ sudo auditctl -l | grep reboot

-a always,exit -F path=/usr/sbin/reboot -F perm=x -F auid>=1000 -F auid!=unset -k privileged-reboot

If the command does not return a line, or the line is commented out, this is a finding.

Fix

Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "reboot" command by adding or updating the following rule in the "/etc/audit/rules.d/audit.rules" file:

-a always,exit -F path=/usr/sbin/reboot -F perm=x -F auid>=1000 -F auid!=unset -k privileged-reboot

The audit daemon must be restarted for the changes to take effect.
This website is not created by, run, approved, or endorsed by the U.S. Department of Defense. Use at your own risk. This website is created by open-source software.