4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - /etc/selinux

Information

Monitor SELinux/AppArmor mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to the /etc/selinux or /etc/apparmor and /etc/apparmor.d directories.

Rationale:

Changes to files in these directories could indicate that an unauthorized user is attempting to modify access controls and change security contexts, leading to a compromise of the system.

Solution

On systems using SELinux add the following line to the /etc/audit/audit.rules file:

-w /etc/selinux/ -p wa -k MAC-policy
-w /usr/share/selinux/ -p wa -k MAC-policy

On systems using AppArmor add the following line to the /etc/audit/audit.rules file:

-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy

Impact:

Auditing can produce a large amount of information, creating large and/or many audit log files.

Notes:

Reloading the auditd config to set active settings may require a system reboot.

See Also

https://workbench.cisecurity.org/files/2619

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, CSCv7|5.5

Plugin: Unix

Control ID: fff8ec92cbc4c5ff7ad947053678595afb96c5630018c2e075de0916409767d2