STIGQter: STIG Summary: Oracle Linux 8 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

OL 8 must generate audit records for any use of the "setfiles" command.

DISA Rule

SV-248765r958442_rule

Vulnerability Number

V-248765

Group Title

SRG-OS-000062-GPOS-00031

Rule Version

OL08-00-030314

Severity

CAT II

CCI(s)

CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.

Weight

Fix Recommendation

Configure OL 8 to audit the execution of the "setfiles" command by adding or updating the following lines to "/etc/audit/rules.d/audit.rules":

-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update

The audit daemon must be restarted for the changes to take effect. To restart the audit daemon, run the following command:

$ sudo service auditd restart

Check Contents

Verify OL 8 is configured to audit the execution of the "setfiles" command by running the following command:

$ sudo grep -w setfiles /etc/audit/audit.rules

-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update

If the command does not return all lines or the lines are commented out, this is a finding.

Note: The "-k" allows for specifying an arbitrary identifier, and the string after it does not need to match the example output above.

Vulnerability Number

V-248765

Documentable

False

Rule Version

OL08-00-030314

Severity Override Guidance

Check Content Reference

Target Key

5416