Audit file system mounts and unmounts by users

Description

auditd rules in /etc/audit/rules.d/60-cirsec-mounts.rules, key mounts: mount, umount and umount2 called by users who logged in, 64-bit and 32-bit programs.

Rationale

Mounting a USB key or a network share is a common way to take data out of a system or bring tools in. The records show who mounted what and when.

Impact

None known.

Setting

Audit

1. Run auditctl -l as root. It must list the rules shown below (keys mounts).
2. Run grep -h . /etc/audit/rules.d/*.rules. The same rules must be present, so they load at boot.

Expected rules, as auditctl -l prints them:

-a always,exit -F arch=b64 -S mount,umount2 -F auid>=1000 -F auid!=-1 -F key=mounts
-a always,exit -F arch=b32 -S mount,umount,umount2 -F auid>=1000 -F auid!=-1 -F key=mounts

Automated: every check must pass. Scanners report each check by its id.

rules

Rules loaded in the kernel and present in /etc/audit/rules.d.

script: |
  command -v auditctl >/dev/null 2>&1 || { echo "auditctl not found: auditd is not installed"; exit 1; }
  want() {
  cat <<'RULES'
  -a always,exit -F arch=b64 -S mount,umount2 -F auid>=1000 -F auid!=-1 -F key=mounts
  -a always,exit -F arch=b32 -S mount,umount,umount2 -F auid>=1000 -F auid!=-1 -F key=mounts
  RULES
  }
  loaded=$(auditctl -l 2>&1) || { echo "$loaded"; exit 3; }
  disk=$(cat /etc/audit/rules.d/*.rules 2>/dev/null)
  n=0 rc=0
  while IFS= read -r r; do
    [ -n "$r" ] || continue
    n=$((n + 1))
    printf '%s\n' "$loaded" | grep -Fxq -- "$r" || { echo "not loaded: $r"; rc=1; }
    printf '%s\n' "$disk" | grep -Fxq -- "$r" || { echo "not in /etc/audit/rules.d: $r"; rc=1; }
  done <<EOF
  $(want)
  EOF
  [ "$rc" = 1 ] || echo "$n rules loaded and present in /etc/audit/rules.d"
  exit "$rc"

Remediation

1. Write the expected rules to /etc/audit/rules.d/60-cirsec-mounts.rules (mode 0640).
2. Run augenrules --load. If auditctl -s shows enabled 2, the configuration is locked: reboot to load the new rules.

Rollback

Delete /etc/audit/rules.d/60-cirsec-mounts.rules and run augenrules --load (or reboot if the configuration is locked).

rules-file

command -v augenrules >/dev/null 2>&1 || { echo "auditd is not installed" >&2; exit 1; }
want() {
cat <<'RULES'
-a always,exit -F arch=b64 -S mount,umount2 -F auid>=1000 -F auid!=-1 -F key=mounts
-a always,exit -F arch=b32 -S mount,umount,umount2 -F auid>=1000 -F auid!=-1 -F key=mounts
RULES
}
f=/etc/audit/rules.d/60-cirsec-mounts.rules
t=$(mktemp)
{ echo '# Written by CIRSEC Baselines CB-UBU-AUDIT-022'; want; } >"$t"
if ! cmp -s "$t" "$f"; then
  cb_backup "$f"
  cat "$t" >"$f"
fi
rm -f "$t"
chmod 640 "$f"
if auditctl -s | grep -q '^enabled 2'; then
  echo "audit rules are locked (-e 2): reboot to load $f"
else
  augenrules --load >/dev/null
fi

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• audit.rules(7), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• auditctl(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R73) ANSSI, guide, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-UBU-AUDIT-011 Install and run the audit daemon
• related CB-UBU-AUDIT-029 Lock the audit configuration and load every valid rule

People and lifecycle