Ensure events that modify the system's Mandatory Access Controls are collected

NiskaNivo 2Automatskalinux

Opis

Monitor AppArmor, an implementation of mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to the /etc/apparmor/ and /usr/share/apparmor/ directories. Note: If a different Mandatory Access Control method is used, changes to the corresponding directories should be audited.

Kako se proverava

Metod provere: Komanda ljuske

shell

alt0() { o=$(bash -c 'awk '"'"'/^ *-w/ &&(/\/etc\/apparmor/ ||/\/usr\/share\/apparmor/) &&/ +-p *wa/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'"'"' /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/apparmor -p wa -k MAC-policy' || { echo step1: missing '-w /etc/apparmor -p wa -k MAC-policy'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /usr/share/apparmor -p wa -k MAC-policy' || { echo step1: missing '-w /usr/share/apparmor -p wa -k MAC-policy'; return 1; }; o=$(bash -c 'auditctl -l | awk '"'"'/^ *-w/ &&(/\/etc\/apparmor/ ||/\/usr\/share\/apparmor/) &&/ +-p *wa/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/apparmor -p wa -k MAC-policy' || { echo step2: missing '-w /etc/apparmor -p wa -k MAC-policy'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /usr/share/apparmor -p wa -k MAC-policy' || { echo step2: missing '-w /usr/share/apparmor -p wa -k MAC-policy'; return 1; }; }; if alt0; then echo compliant; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Note: If a different Mandatory Access Control method is used, changes to the corresponding directories should be audited. Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor events that modify the system's Mandatory Access Controls. Example: # printf " -w /etc/apparmor -p wa -k MAC-policy -w /usr/share/apparmor -p wa -k MAC-policy " >> /etc/audit/rules.d/50-MAC-policy.rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

Svojstva

Operativni sistemi: sles-15
Oznake: cis-convertedlinux
Referenca: CIS SUSE Linux Enterprise 15 Benchmark v2.0.1 - 6.3.3.14

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target linux --level 2