STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

Red Hat Enterprise Linux CoreOS (RHCOS) must initiate session audits at system startup.

DISA Rule

SV-257519r960888_rule

Vulnerability Number

V-257519

Group Title

SRG-APP-000092-CTR-000165

Rule Version

CNTR-OS-000170

Severity

CAT I

CCI(s)

• CCI-001464 - Initiates session audits automatically at system start-up.

Weight

10

Fix Recommendation

Apply the machine config by executing the following:

for mcpool in $(oc get mcp -oname | sed "s:.*/::" ); do
echo "apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
name: 05-kernelarg-audit-enabled-$mcpool
labels:
machineconfiguration.openshift.io/role: $mcpool
spec:
config:
ignition:
version: 3.1.0
kernelArguments:
- audit=1
- audit_backlog_limit=8192
" | oc create -f -
done

Check Contents

Verify the RHCOS boot loader configuration has audit enabled, including backlog:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; grep audit /boot/loader/entries/*.conf || echo "not found"' 2>/dev/null; done

If "audit" is not set to "1" or returns "not found", this is a finding.

If "audit_backlog" is not set to 8192 or returns "not found", this is a finding.

Vulnerability Number

V-257519

Documentable

False

Rule Version

CNTR-OS-000170

Severity Override Guidance

Verify the RHCOS boot loader configuration has audit enabled, including backlog:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; grep audit /boot/loader/entries/*.conf || echo "not found"' 2>/dev/null; done

If "audit" is not set to "1" or returns "not found", this is a finding.

If "audit_backlog" is not set to 8192 or returns "not found", this is a finding.

Check Content Reference

M

Target Key

5547