STIGQter: STIG Summary: SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SLEM 5 must protect audit rules from unauthorized modification.

DISA Rule

SV-261418r996665_rule

Vulnerability Number

V-261418

Group Title

SRG-OS-000057-GPOS-00027

Rule Version

SLEM-05-653050

Severity

CAT II

CCI(s)

CCI-000162 - Protect audit information from unauthorized access.
CCI-000163 - Protect audit information from unauthorized modification.
CCI-000164 - Protect audit information from unauthorized deletion.

Weight

Fix Recommendation

Configure SLEM 5 to protect audit rules from unauthorized modification.

Add or modify the following lines in "/etc/permissions.local":

/var/log/audit root:root 600
/var/log/audit/audit.log root:root 600
/etc/audit/audit.rules root:root 640
/etc/audit/rules.d/audit.rules root:root 640

Set the correct permissions with the following command:

> sudo chkstat --set /etc/permissions.local

Check Contents

Verify that SLEM 5 protects audit rules from unauthorized modification with the following command:

> grep -i audit /etc/permissions.local
/var/log/audit root:root 600
/var/log/audit/audit.log root:root 600
/etc/audit/audit.rules root:root 640
/etc/audit/rules.d/audit.rules root:root 640

If the command does not return any output or all four lines as shown, this is a finding.

Check that all of the audit information files and folders have the correct permissions with the following command:

> sudo chkstat /etc/permissions.local

If the command returns any output, this is a finding.

Vulnerability Number

V-261418

Documentable

False

Rule Version

SLEM-05-653050

Severity Override Guidance

Check Content Reference

Target Key

5596