[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244411

 
 

909

 
 

193363

 
 

277

Paid content will be excluded from the download.


Download | Alert*
OVAL

Collect kernel module loading and unloading

ID: oval:org.secpod.oval:def:46265Date: (C)2018-07-05   (M)2023-12-20
Class: COMPLIANCEFamily: unix




Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of "modules". Monitoring the use of insmod, rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.

Platform:
Ubuntu 16.04
Reference:
CCE-92004-1
CCE    1
CCE-92004-1
XCCDF    1
xccdf_org.secpod_benchmark_general_Ubuntu_16_04

© SecPod Technologies