STIGQter: STIG Summary: Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

Ubuntu 22.04 LTS must be configured so that audit configuration files are not write-accessible by unauthorized users.

DISA Rule

SV-260601r958444_rule

Vulnerability Number

V-260601

Group Title

SRG-OS-000063-GPOS-00032

Rule Version

UBTU-22-653065

Severity

CAT II

CCI(s)

CCI-000171 - Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.

Weight

Fix Recommendation

Configure /etc/audit/audit.rules", "/etc/audit/auditd.conf", and "/etc/audit/rules.d/*" files to have a mode of "640" by using the following command:

$ sudo chmod -R 640 /etc/audit/audit.rules /etc/audit/auditd.conf /etc/audit/rules.d/*

Check Contents

Verify that "/etc/audit/audit.rules", "/etc/audit/auditd.conf", and "/etc/audit/rules.d/*" files have a mode of "640" or less permissive by using the following command:

$ sudo ls -al /etc/audit/audit.rules /etc/audit/auditd.conf /etc/audit/rules.d/* | awk '{print $1, $9}'
-rw-r----- /etc/audit/audit.rules
-rw-r----- /etc/audit/auditd.conf
-rw-r----- /etc/audit/rules.d/audit.rules

If "/etc/audit/audit.rules", "/etc/audit/auditd.conf", or "/etc/audit/rules.d/*" files have a mode more permissive than "640", this is a finding.

Vulnerability Number

V-260601

Documentable

False

Rule Version

UBTU-22-653065

Severity Override Guidance

Check Content Reference

Target Key

5594