SOCLE-RUN-AUD-017// Audit (auditd)mediumeffective runtime

Record Events When Executables Are Run As Another User

Enforces an auditd rule (key user_emulation) that records when a process runs under a different user identity than the logged-in auid.

Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →

Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04

✓ One check, maps to 1 standard

CIS

6.2.3.2 · 6.3.3.2

direct

Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

An audit log of users running commands with temporary elevated privileges (via sudo/su, where the real uid differs from the audit uid auid) is essential to reporting and accountability. Administrators correlate these audit records with sudo's own logfile to confirm no unauthorized commands were run. Misuse of privileged functions, by careless authorized users or by an attacker on a compromised account, is a serious, ongoing concern, and auditing privilege emulation is a primary way to detect such misuse and insider/advanced-persistent-threat activity.

What Pavois checks

Pavois runs auditctl -l and checks a rule with the key user_emulation is loaded. Reading the live kernel ruleset beats parsing /etc/audit/rules.d/*.rules: a rule on disk that was never loaded (no augenrules --load, syntax error, reload failure) would make a file scanner falsely pass. auditctl -l reflects what the kernel audits now.

describe command('auditctl -l') do
  its('stdout') { should match(/(-k +|key=)user_emulation\b/) }
end
describe command("grep -rhwsE 'user_emulation' /etc/audit/rules.d/*.rules /etc/audit/audit.rules 2>/dev/null") do
  its('stdout') { should match(/\S/) }
end

How to verify it is applied

Run auditctl -l | grep -E '(-k |key=)user_emulation' (as root). Expected output is the syscall rules tracking privilege emulation, for example:

-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation
-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation

No output means the rules are not loaded.

Inspect & investigate

Events go to /var/log/audit/audit.log. After running a command via sudo, find the record with grep 'key="user_emulation"' /var/log/audit/audit.log (grep the raw log; ausearch can falsely report no matches). The record shows the auid, the effective uid, the executed program and the timestamp.

Remediation

pavois harden apply uses the audit_ruleset resource to add the missing user_emulation syscall rules to a Pavois-managed drop-in in /etc/audit/rules.d/ and load them. Because the audit subsystem is locked once running, the change is fully effective only after a reboot (reboot_required: true).

Pavois applies this with its own harden engine, the plan below, not a shell script:

reboot_required	true
resource	audit_ruleset

pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

These are passive syscall watches, they never block privilege emulation, so sudo/su keep working; they only add records to /var/log/audit/audit.log. Precautions:

Because the rule fires on every execve where euid != uid, hosts with heavy sudo usage (automation, CI runners) can generate substantial audit volume, ensure /var/log/audit has space and rotation, and consider auditd's backlog limits.
If the ruleset is immutable (-e 2), the rule can only be added after a reboot.
Confirm the rule parsed with augenrules --load and re-check auditctl -l.

Standards mapping

Standard	Reference	Type	Version	Confidence
CIS	6.2.3.2, 6.3.3.2	direct	per OS, see the benchmark table	high

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references