STIGQter: STIG Summary: SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SLEM 5 must generate audit records for all uses of privileged functions.

DISA Rule

SV-261462r996793_rule

Vulnerability Number

V-261462

Group Title

SRG-OS-000327-GPOS-00127

Rule Version

SLEM-05-654195

Severity

CAT II

CCI(s)

• CCI-002234 - Log the execution of privileged functions.
• CCI-001914 - Provide the capability for organization-defined individuals or roles to change the logging to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds.
• CCI-001875 - Provide an audit reduction capability that supports on-demand audit review and analysis.
• CCI-001877 - Provide an audit reduction capability that supports after-the-fact investigations of incidents.
• CCI-001878 - Provide a report generation capability that supports on-demand audit review and analysis.
• CCI-001879 - Provide a report generation capability that supports on-demand reporting requirements.
• CCI-001880 - Provide a report generation capability that supports after-the-fact investigations of security incidents.
• CCI-001881 - Provide an audit reduction capability that does not alter original content or time ordering of audit records.
• CCI-001882 - Provide a report generation capability that does not alter original content or time ordering of audit records.
• CCI-001889 - Record time stamps for audit records that meet organization-defined granularity of time measurement.
• CCI-001890 - Record time stamps for audit records that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.

Weight

10

Fix Recommendation

Configure SLEM 5 to generate an audit record for any privileged use of the "execve" system call.

Add or modify the following lines in "/etc/audit/rules.d/audit.rules" file:

-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid
-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid
-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid
-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid

To reload the rules file, restart the audit daemon:

> sudo systemctl restart auditd.service

or issue the following command:

> sudo augenrules --load

Check Contents

Verify SLEM 5 generates an audit record for any privileged use of the "execve" system call with the following command:

> sudo auditctl -l | grep -w 'execve'
-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -F key=setuid
-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=setuid
-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -F key=setgid
-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -F key=setgid

If both the "b32" and "b64" audit rules for "SUID" files are not defined, this is a finding.

If both the "b32" and "b64" audit rules for "SGID" files are not defined, this is a finding.

Note: The "key=" value is arbitrary and can be different from the example output above.

Vulnerability Number

V-261462

Documentable

False

Rule Version

SLEM-05-654195

Severity Override Guidance

Verify SLEM 5 generates an audit record for any privileged use of the "execve" system call with the following command:

> sudo auditctl -l | grep -w 'execve'
-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -F key=setuid
-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=setuid
-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -F key=setgid
-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -F key=setgid

If both the "b32" and "b64" audit rules for "SUID" files are not defined, this is a finding.

If both the "b32" and "b64" audit rules for "SGID" files are not defined, this is a finding.

Note: The "key=" value is arbitrary and can be different from the example output above.

Check Content Reference

M

Target Key

5596