STIGQter STIGQter: STIG Summary: SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

Successful/unsuccessful uses of "setfiles" in SLEM 5 must generate an audit record.

DISA Rule

SV-261466r996805_rule

Vulnerability Number

V-261466

Group Title

SRG-OS-000062-GPOS-00031

Rule Version

SLEM-05-654215

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "setfiles" command.

Add or modify the following lines in the "/etc/audit/rules.d/audit.rules" file:

-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update

To reload the rules file, restart the audit daemon:

> sudo systemctl restart auditd.service

or issue the following command:

> sudo augenrules --load

Check Contents

Verify SLEM 5 generates an audit record for all uses of the "setfiles" command with the following command:

> sudo grep -w "setfiles" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update

If the command does not return a line, or the line is commented out, this is a finding.

Note: The "key=" value is arbitrary and can be different from the example output above.

Vulnerability Number

V-261466

Documentable

False

Rule Version

SLEM-05-654215

Severity Override Guidance

Verify SLEM 5 generates an audit record for all uses of the "setfiles" command with the following command:

> sudo grep -w "setfiles" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update

If the command does not return a line, or the line is commented out, this is a finding.

Note: The "key=" value is arbitrary and can be different from the example output above.

Check Content Reference

M

Target Key

5596