Ensure events that modify the system's Mandatory Access Controls are collected

НискаНиво 2Аутоматскаlinux

Опис

Monitor SELinux mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to the /etc/selinux/ and /usr/share/selinux/ directories. Note: • If a different Mandatory Access Control method is used, changes to the corresponding directories should be audited. • Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

Како се проверава

Метод провере: Команда љуске

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep MAC-policy /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/MAC_policy.rules:-w /etc/selinux/ -p wa -k MAC-policy' || { echo step1: missing '/etc/audit/rules.d/MAC_policy.rules:-w /etc/selinux/ -p wa -'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/MAC_policy.rules:-w /usr/share/selinux/ -p wa -k MAC-policy' || { echo step1: missing '/etc/audit/rules.d/MAC_policy.rules:-w /usr/share/selinux/ -'; return 1; }; command -v auditctl >/dev/null 2>&1 || { echo "step2: auditctl not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'auditctl -l | grep MAC-policy' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/selinux/ -p wa -k MAC-policy' || { echo step2: missing '-w /etc/selinux/ -p wa -k MAC-policy'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /usr/share/selinux/ -p wa -k MAC-policy' || { echo step2: missing '-w /usr/share/selinux/ -p wa -k MAC-policy'; return 1; }; }; if alt0; then echo compliant; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules Example: vi /etc/audit/rules.d/MAC_policy.rules and add the following lines: -w /etc/selinux/ -p wa -k MAC-policy -w /usr/share/selinux/ -p wa -k MAC-policy

Својства

Оперативни системи: sles-12
Ознаке: cis-convertedlinux
Референца: CIS SUSE Linux Enterprise 12 Benchmark v3.2.0 - 4.1.6

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target linux --level 2