STIGQter: STIG Summary: Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Jul 2026:

AlmaLinux OS 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.

DISA Rule

SV-269483r1134836_rule

Vulnerability Number

V-269483

Group Title

SRG-OS-000037-GPOS-00015

Rule Version

ALMA-09-048970

Severity

CAT II

CCI(s)

• CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.
• CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.
• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
• CCI-002884 - Log organization-defined audit events for nonlocal maintenance and diagnostic sessions.
• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

Weight

10

Fix Recommendation

Configure AlmaLinux OS 9 to generate audit records upon successful/unsuccessful attempts to use the "rename", "unlink", "rmdir", "renameat", and "unlinkat" syscalls.

Add the following to the "/etc/audit/rules.d/audit.rules" file:

-a always,exit -F arch=b64 -S rename,unlink,rmdir,unlinkat,renameat -F auid>=1000 -F auid!=unset -F key=delete
-a always,exit -F arch=b32 -S rename,unlink,rmdir,unlinkat,renameat -F auid>=1000 -F auid!=unset -F key=delete

Merge the rules into /etc/audit/audit.rules:

$ augenrules --load

Check Contents

Verify that AlmaLinux OS 9 is configured to audit the execution of the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls with the following command:

$ auditctl -l | grep rename

-a always,exit -F arch=b32 -S unlink,rename,rmdir,unlinkat,renameat -F auid>=1000 -F auid!=unset -F key=delete
-a always,exit -F arch=b64 -S rename,rmdir,unlink,unlinkat,renameat -F auid>=1000 -F auid!=unset -F key=delete

If both the "b32" and "b64" audit rules are not defined for the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls, or any of the lines returned are commented out, this is a finding.

Vulnerability Number

V-269483

Documentable

False

Rule Version

ALMA-09-048970

Severity Override Guidance

Verify that AlmaLinux OS 9 is configured to audit the execution of the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls with the following command:

$ auditctl -l | grep rename

-a always,exit -F arch=b32 -S unlink,rename,rmdir,unlinkat,renameat -F auid>=1000 -F auid!=unset -F key=delete
-a always,exit -F arch=b64 -S rename,rmdir,unlink,unlinkat,renameat -F auid>=1000 -F auid!=unset -F key=delete

If both the "b32" and "b64" audit rules are not defined for the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls, or any of the lines returned are commented out, this is a finding.

Check Content Reference

M

Target Key

5664