Ensure events that modify the system's Mandatory Access Controls are collected

НискаНиво 2Аутоматскаlinux

Опис

Monitor AppArmor, an implementation of mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to the /etc/apparmor/ and /usr/share/apparmor/ directories. Note: If a different Mandatory Access Control method is used, changes to the corresponding directories should be audited.

Како се проверава

Метод провере: Команда љуске

shell

alt0() { o=$(bash -c 'awk '"'"'/^ *-w/ &&(/\/etc\/apparmor/ ||/\/usr\/share\/apparmor/) &&/ +-p *wa/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'"'"' /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/apparmor -p wa -k MAC-policy' || { echo step1: missing '-w /etc/apparmor -p wa -k MAC-policy'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /usr/share/apparmor -p wa -k MAC-policy' || { echo step1: missing '-w /usr/share/apparmor -p wa -k MAC-policy'; return 1; }; o=$(bash -c 'auditctl -l | awk '"'"'/^ *-w/ &&(/\/etc\/apparmor/ ||/\/usr\/share\/apparmor/) &&/ +-p *wa/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/apparmor -p wa -k MAC-policy' || { echo step2: missing '-w /etc/apparmor -p wa -k MAC-policy'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /usr/share/apparmor -p wa -k MAC-policy' || { echo step2: missing '-w /usr/share/apparmor -p wa -k MAC-policy'; return 1; }; }; if alt0; then echo compliant; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Note: If a different Mandatory Access Control method is used, changes to the corresponding directories should be audited. Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor events that modify the system's Mandatory Access Controls. Example: # printf " -w /etc/apparmor -p wa -k MAC-policy -w /usr/share/apparmor -p wa -k MAC-policy " >> /etc/audit/rules.d/50-MAC-policy.rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

Својства

Оперативни системи: sles-15
Ознаке: cis-convertedlinux
Референца: CIS SUSE Linux Enterprise 15 Benchmark v2.0.1 - 6.3.3.14

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target linux --level 2