Ensure events that modify the system's Mandatory Access Controls are collected

BaixaNível 2Automatizadalinux

Descrição

Monitor SELinux mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to the /etc/selinux/ and /usr/share/selinux/ directories. Note: • If a different Mandatory Access Control method is used, changes to the corresponding directories should be audited. • Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

Como é verificado

Método de auditoria: Comando shell

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep MAC-policy /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/MAC_policy.rules:-w /etc/selinux/ -p wa -k MAC-policy' || { echo step1: missing '/etc/audit/rules.d/MAC_policy.rules:-w /etc/selinux/ -p wa -'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/MAC_policy.rules:-w /usr/share/selinux/ -p wa -k MAC-policy' || { echo step1: missing '/etc/audit/rules.d/MAC_policy.rules:-w /usr/share/selinux/ -'; return 1; }; command -v auditctl >/dev/null 2>&1 || { echo "step2: auditctl not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'auditctl -l | grep MAC-policy' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/selinux/ -p wa -k MAC-policy' || { echo step2: missing '-w /etc/selinux/ -p wa -k MAC-policy'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /usr/share/selinux/ -p wa -k MAC-policy' || { echo step2: missing '-w /usr/share/selinux/ -p wa -k MAC-policy'; return 1; }; }; if alt0; then echo compliant; fi

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules Example: vi /etc/audit/rules.d/MAC_policy.rules and add the following lines: -w /etc/selinux/ -p wa -k MAC-policy -w /usr/share/selinux/ -p wa -k MAC-policy

Propriedades

Sistemas operacionais: sles-12
Tags: cis-convertedlinux
Referência: CIS SUSE Linux Enterprise 12 Benchmark v3.2.0 - 4.1.6

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target linux --level 2