Ensure events that modify the system's Mandatory Access Controls are collected

BajaNivel 2Automatizadalinux

Descripción

Monitor SELinux mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to the /etc/selinux/ and /usr/share/selinux/ directories. Note: • If a different Mandatory Access Control method is used, changes to the corresponding directories should be audited. • Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

Cómo se verifica

Método de auditoría: Comando de shell

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep MAC-policy /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/MAC_policy.rules:-w /etc/selinux/ -p wa -k MAC-policy' || { echo step1: missing '/etc/audit/rules.d/MAC_policy.rules:-w /etc/selinux/ -p wa -'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/MAC_policy.rules:-w /usr/share/selinux/ -p wa -k MAC-policy' || { echo step1: missing '/etc/audit/rules.d/MAC_policy.rules:-w /usr/share/selinux/ -'; return 1; }; command -v auditctl >/dev/null 2>&1 || { echo "step2: auditctl not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'auditctl -l | grep MAC-policy' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/selinux/ -p wa -k MAC-policy' || { echo step2: missing '-w /etc/selinux/ -p wa -k MAC-policy'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /usr/share/selinux/ -p wa -k MAC-policy' || { echo step2: missing '-w /usr/share/selinux/ -p wa -k MAC-policy'; return 1; }; }; if alt0; then echo compliant; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules Example: vi /etc/audit/rules.d/MAC_policy.rules and add the following lines: -w /etc/selinux/ -p wa -k MAC-policy -w /usr/share/selinux/ -p wa -k MAC-policy

Propiedades

Sistemas operativos: sles-12
Etiquetas: cis-convertedlinux
Referencia: CIS SUSE Linux Enterprise 12 Benchmark v3.2.0 - 4.1.6

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target linux --level 2