STIGQter: STIG Summary: SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SLEM 5 audit tools must have the proper permissions configured to protect against unauthorized access.

DISA Rule

SV-261419r996668_rule

Vulnerability Number

V-261419

Group Title

SRG-OS-000256-GPOS-00097

Rule Version

SLEM-05-653055

Severity

CAT II

CCI(s)

CCI-001493 - Protect audit tools from unauthorized access.
CCI-001494 - Protect audit tools from unauthorized modification.
CCI-001495 - Protect audit tools from unauthorized deletion.

Weight

Fix Recommendation

Configure SLEM 5 audit tools to have proper permissions set in the permissions profile.

Add or modify the following lines in the "/etc/permissions.local" file:

/usr/sbin/audispd root:root 750
/usr/sbin/auditctl root:root 750
/usr/sbin/auditd root:root 750
/usr/sbin/ausearch root:root 755
/usr/sbin/aureport root:root 755
/usr/sbin/autrace root:root 750
/usr/sbin/augenrules root:root 750

Check Contents

To protect from unauthorized access verify that SLEM 5 audit tools have the proper permissions configured in the permissions profile by using the following command:

> grep "^/usr/sbin/au" /etc/permissions.local
/usr/sbin/audispd root:root 750
/usr/sbin/auditctl root:root 750
/usr/sbin/auditd root:root 750
/usr/sbin/ausearch root:root 755
/usr/sbin/aureport root:root 755
/usr/sbin/autrace root:root 750
/usr/sbin/augenrules root:root 750

If the command does not return any output, this is a finding.

Vulnerability Number

V-261419

Documentable

False

Rule Version

SLEM-05-653055

Severity Override Guidance

Check Content Reference

Target Key

5596