# Ensure kernel module loading unloading and modification is collected

Necessity: Kernel modules extend the functionality of the core operating system, running with the highest privileges. An attacker could introduce a malicious module (e.g., a rootkit) to gain persistent, privileged control over the system, hide their activities, or disable security controls. Auditing all kernel module loading, unloading, and modification events is therefore critical for detecting unauthorized system changes, potential rootkit installations, or system instability caused by faulty modules. Failure to monitor these activities creates a major security blind spot at the kernel level.

Auditing and Remediation: The audit script inspects the currently loaded auditd rules to verify that specific rules are in place to monitor the syscalls and helper utilities responsible for managing kernel modules. The remediation script adds these rules to the auditd configuration files and triggers a reload, ensuring that all subsequent module-related activities are logged.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict is uniformly 'Present'. This is a foundational security measure without a meaningful gradient. The system is either monitoring for kernel-level modifications or it is not. Any configuration less than 'Present' leaves the system vulnerable to kernel-level compromise, which is a critical risk. Therefore, security benchmarks like CIS mandate that this logging is enabled in all secure environments.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Present']` |
| **Moderate** | `['Present']` |
| **Strict** | `['Present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the auditd rules for kernel module loading, unloading, and modification are correctly configured. The script should parse the output of `auditctl -l` to verify the presence of rules that watch the syscalls `init_module`, `finit_module`, `delete_module`, and `create_module`, as well as file watches on `/sbin/insmod`, `/sbin/rmmod`, and `/sbin/modprobe`. The script must return only the string `'Present'` if all required rules are configured, or `'Absent'` if any are missing, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts one argument: `'Present'`. If the argument is `'Present'`, the script must add the necessary auditd rules to a configuration file within `/etc/audit/rules.d/`. The rules must log all attempts to load, unload, or modify kernel modules, covering syscalls (`init_module`, `finit_module`, `delete_module`, `create_module`) for both 32-bit and 64-bit architectures, and file watches on `/sbin/insmod`, `/sbin/rmmod`, and `/sbin/modprobe`. The script must then reload the auditd rules to apply the changes. It must return only the boolean `true` upon success and `false` upon failure.

