Record Events that Modify the System's Network Environment
Ensures auditd has an active rule tagged system-locale (or audit_rules_networkconfig_modification) that records changes to network identity and configuration (sethostname/setdomainname syscalls and files like /etc/hosts, /etc/hostname, /etc/issue, network config dirs).
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The network environment (hostname, domain, hosts file, interface configuration) should not be modified by anything other than deliberate administrator action. An attacker altering DNS resolution, the hostname or routing can redirect traffic or evade detection. Auditing every change to network parameters preserves a record for review and investigation.
What Pavois checks
Pavois runs auditctl -l and checks for a loaded rule carrying the system-locale (or audit_rules_networkconfig_modification) key. Reading the live kernel ruleset beats parsing /etc/audit/rules.d/*.rules: a rule present in a file but not loaded gives false assurance. auditctl -l reflects only what the kernel enforces now.
describe command('auditctl -l') do
its('stdout') { should match(/(-k +|key=)(audit_rules_networkconfig_modification|system-locale)\b/) }
end
describe command("grep -rhwsE '(audit_rules_networkconfig_modification|system-locale)' /etc/audit/rules.d/*.rules /etc/audit/audit.rules 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run auditctl -l | grep system-locale. You should see a syscall rule such as -a always,exit -F arch=b64 -S sethostname,setdomainname -k system-locale plus watches like -w /etc/hosts -p wa -k system-locale and -w /etc/hostname -p wa -k system-locale. Empty output means the rule is not loaded.
Inspect & investigate
Triggered events land in /var/log/audit/audit.log. Search with grep 'key="system-locale"' /var/log/audit/audit.log (prefer grep over ausearch -k system-locale, which can wrongly report no matches).
Remediation
Pavois's harden plan uses the audit_ruleset resource to write the network-environment syscall and watch rules into /etc/audit/rules.d/, then reloads auditd. Because the audit config may be immutable, a reboot is required to fully apply. Run pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| reboot_required | true |
|---|---|
| resource | audit_ruleset |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without this rule, changes to hostname, DNS resolution and interface config go unrecorded, easing traffic redirection and evasion. The rule is log-only and cannot block changes, so it breaks nothing. Precautions: cloud-init, DHCP clients and network managers legitimately rewrite these files at boot, generating events, size audit.log rotation and space_left_action so a full disk does not halt the host when auditd is set to halt.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 10.3.4, 6.2.3.5, 6.3.3.5, 6.3.3.7, 6.3.3.6, 6.3.3.8, 6.3.3.9 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.7, AC-6(9), AU-12(c), AU-2(d), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 10.3.4 | supporting | 4.0.1 | medium |
| ANSSI BP-028 | R73 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.