STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Mar 2026:

Successful/unsuccessful uses of the umount2 system call in TOSS 5 must generate an audit record.

DISA Rule

SV-282423r1201569_rule

Vulnerability Number

V-282423

Group Title

SRG-OS-000037-GPOS-00015

Rule Version

TOSS-05-000451

Severity

CAT II

CCI(s)

CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.
CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
CCI-002884 - Log organization-defined audit events for nonlocal maintenance and diagnostic sessions.
CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

Weight

Fix Recommendation

Configure the audit system to generate an audit event for any successful/unsuccessful use of the "umount2" system call by adding or updating the following rules in "/etc/audit/audit.rules" and adding the following rules to "/etc/audit/rules.d/perm_mod.rules" or updating the existing rules in files in the "/etc/audit/rules.d/" directory:

-a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -k perm_mod
-a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -k perm_mod

Restart the audit daemon for changes to take effect.

Check Contents

To determine if the system is configured to audit calls to the umount2 system call, run the following command:

$ sudo grep "umount2" /etc/audit/audit.*

If no line is returned, this is a finding.

Vulnerability Number

V-282423

Documentable

False

Rule Version

TOSS-05-000451

Severity Override Guidance

To determine if the system is configured to audit calls to the umount2 system call, run the following command:

$ sudo grep "umount2" /etc/audit/audit.*

If no line is returned, this is a finding.

Check Content Reference

Target Key

5738