STIGQter STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must protect audit information from unauthorized modification.

DISA Rule

SV-257533r960933_rule

Vulnerability Number

V-257533

Group Title

SRG-APP-000119-CTR-000245

Rule Version

CNTR-OS-000310

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Apply the machine config to prevent unauthorized changes by executing the following:

for mcpool in $(oc get mcp -oname | sed "s:.*/::" ); do
echo "apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
name: 90-immutable-rules-$mcpool
labels:
machineconfiguration.openshift.io/role: $mcpool
spec:
config:
ignition:
version: 3.1.0
storage:
files:
- contents:
source: data:,-e%202%0A
mode: 0600
path: /etc/audit/rules.d/90-immutable.rules
overwrite: true
" | oc apply -f -
done

Check Contents

Verify the audit system prevents unauthorized changes by executing the following command:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n ""$HOSTNAME ""; grep "^\-e\s2\s*$" /etc/audit/audit.rules /etc/audit/rules.d/* || echo "not found"' 2>/dev/null; done

If the check returns "not found", the audit system is not set to be immutable by adding the ""-e 2"" option to the ""/etc/audit/audit.rules"", this is a finding.

Vulnerability Number

V-257533

Documentable

False

Rule Version

CNTR-OS-000310

Severity Override Guidance

Verify the audit system prevents unauthorized changes by executing the following command:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n ""$HOSTNAME ""; grep "^\-e\s2\s*$" /etc/audit/audit.rules /etc/audit/rules.d/* || echo "not found"' 2>/dev/null; done

If the check returns "not found", the audit system is not set to be immutable by adding the ""-e 2"" option to the ""/etc/audit/audit.rules"", this is a finding.

Check Content Reference

M

Target Key

5547