TOSS 5 audit system must protect login user identifiers (UIDs) from unauthorized change.

If modification of login UIDs is not prevented, they can be changed by nonprivileged users and make auditing complicated or impossible.

Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000462-GPOS-00206, SRG-OS-000475-GPOS-00220

Verify the audit system prevents unauthorized changes to login UIDs using the following command:

$ sudo grep -i immutable /etc/audit/audit.rules

--loginuid-immutable

If the "--loginuid-immutable" option is not returned in the "/etc/audit/audit.rules", or the line is commented out, this is a finding.

Configure TOSS 5 auditing to prevent modification of login UIDs once they are set by adding the following line to "/etc/audit/rules.d/audit.rules":

--loginuid-immutable

Restart the audit daemon for the changes to take effect.