Ensure events that modify the system's Mandatory Access Controls are collected

DüşükDüzey 2Otomatiklinux

Açıklama

Monitor AppArmor, an implementation of mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to the /etc/apparmor/ and /usr/share/apparmor/ directories. Note: If a different Mandatory Access Control method is used, changes to the corresponding directories should be audited.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

alt0() { o=$(bash -c 'awk '"'"'/^ *-w/ &&(/\/etc\/apparmor/ ||/\/usr\/share\/apparmor/) &&/ +-p *wa/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'"'"' /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/apparmor -p wa -k MAC-policy' || { echo step1: missing '-w /etc/apparmor -p wa -k MAC-policy'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /usr/share/apparmor -p wa -k MAC-policy' || { echo step1: missing '-w /usr/share/apparmor -p wa -k MAC-policy'; return 1; }; o=$(bash -c 'auditctl -l | awk '"'"'/^ *-w/ &&(/\/etc\/apparmor/ ||/\/usr\/share\/apparmor/) &&/ +-p *wa/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/apparmor -p wa -k MAC-policy' || { echo step2: missing '-w /etc/apparmor -p wa -k MAC-policy'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /usr/share/apparmor -p wa -k MAC-policy' || { echo step2: missing '-w /usr/share/apparmor -p wa -k MAC-policy'; return 1; }; }; if alt0; then echo compliant; fi

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Note: If a different Mandatory Access Control method is used, changes to the corresponding directories should be audited. Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor events that modify the system's Mandatory Access Controls. Example: # printf " -w /etc/apparmor -p wa -k MAC-policy -w /usr/share/apparmor -p wa -k MAC-policy " >> /etc/audit/rules.d/50-MAC-policy.rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

Özellikler

İşletim sistemleri: sles-15
Etiketler: cis-convertedlinux
Referans: CIS SUSE Linux Enterprise 15 Benchmark v2.0.1 - 6.3.3.14

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target linux --level 2