0075-SETroubleshoot-uninstalled-Ensure SETroubleshoot is not installed¶

Rule ID¶

• 0075-SETroubleshoot-uninstalled

Category¶

• system

Severity¶

• warn

Compatible Versions¶

• Linux

Description¶

• prelink is a program that modifies ELF shared libraries and ELF dynamically linked binaries, so that the dynamic linker requires much less time to perform relocations at startup.

Scan Frequency¶

• 1 */5 * * *

Rationale¶

• The prelinking feature may interfere with AIDE operations because it changes binary files. Prelinking also increases system vulnerabilities if a malicious user is able to compromise common libraries such as libc.

Risk Items¶

• Service Unavailable

Audit Method¶

• Verify that prelink is not installed. Run the following command:

# rpm -q prelink
package prelink is not installed

Remediation¶

• Run the following command to restore binaries to normal:

# prelink -ua

Verify that prelink is not installed. Run the following command:

yum remove prelink

Impact¶

• None

Default Value¶

• None

References¶

• None

CIS Controls¶

• Version 7

  14.9 Enforce Detailed Logging for Access or Changes to Sensitive Data Enforce detailed audit logging for access to sensitive data or changes to sensitive data (using tools such as File Integrity Monitoring or Security Information and Event Monitoring).