STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must generate audit records for successful and unsuccessful uses of the "execve" system call.

DISA Rule

SV-281116r1166300_rule

Vulnerability Number

V-281116

Group Title

SRG-OS-000326-GPOS-00126

Rule Version

RHEL-10-500300

Severity

CAT II

CCI(s)

• CCI-002233 - Prevent the organization-defined software from executing at higher privilege levels than users executing the software.
• CCI-002234 - Log the execution of privileged functions.
• CCI-004188 - Monitor the use of maintenance tools that execute with increased privilege.

Weight

10

Fix Recommendation

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "execve" system call.

Add or update the following file system rules to "/etc/audit/rules.d/audit.rules":

-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv
-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv
-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv
-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv

Restart the audit daemon with the following command for the changes to take effect:

$ sudo service auditd restart

Check Contents

Verify RHEL 10 is configured to audit the execution of the "execve" system call with the following command:

$ sudo auditctl -l | grep execve
-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -F key=execpriv
-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=execpriv
-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -F key=execpriv
-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -F key=execpriv

If the command does not return all lines, or the lines are commented out, this is a finding.

Vulnerability Number

V-281116

Documentable

False

Rule Version

RHEL-10-500300

Severity Override Guidance

Verify RHEL 10 is configured to audit the execution of the "execve" system call with the following command:

$ sudo auditctl -l | grep execve
-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -F key=execpriv
-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=execpriv
-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -F key=execpriv
-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -F key=execpriv

If the command does not return all lines, or the lines are commented out, this is a finding.

Check Content Reference

M

Target Key

5733