STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

DISA Rule

SV-281101r1195411_rule

Vulnerability Number

V-281101

Group Title

SRG-OS-000063-GPOS-00032

Rule Version

RHEL-10-500025

Severity

CAT II

CCI(s)

CCI-000171 - Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.

Weight

Fix Recommendation

Configure RHEL 10 so that the files in directory "/etc/audit/rules.d/" and the "/etc/audit/auditd.conf" file have a mode of "0640" with the following commands:

$ sudo chmod 0600 /etc/audit/rules.d/audit.rules
$ sudo chmod 0640 /etc/audit/rules.d/[customrulesfile].rules
$ sudo chmod 0640 /etc/audit/auditd.conf

Check Contents

Verify RHEL 10 sets the files in directory "/etc/audit/rules.d/" and "/etc/audit/auditd.conf" file to have a mode of "0640" or less permissive with the following command:

$ sudo find /etc/audit/rules.d/ /etc/audit/audit.rules /etc/audit/auditd.conf -type f -exec stat -c "%a %n" {} \;
600 /etc/audit/rules.d/audit.rules
640 /etc/audit/audit.rules
640 /etc/audit/auditd.conf

If the audit configuration files have a mode more permissive than those shown, this is a finding.

Vulnerability Number

V-281101

Documentable

False

Rule Version

RHEL-10-500025

Severity Override Guidance

Check Content Reference

Target Key

5733