| name | cis-ubuntu1604-v200-4-1-6 |
| description | Ensure events that modify the system's Mandatory Access Controls are collected |
| category | cis-logging |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-16.04","auditd","logging"] |
| cis_id | 4.1.6 |
| cis_benchmark | CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 - Control 4.1.6
Profile
- Level: 2 - Server
- Level: 2 - Workstation
- Assessment Status: Automated
Description
Monitor AppArmor mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to /etc/apparmor and /etc/apparmor.d directories.
Note: Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.
Rationale
Changes to files in these directories could indicate that an unauthorized user is attempting to modify access controls and change security contexts, leading to a compromise of the system.
Impact
None.
Audit Procedure
Command Line
Run the following command to verify the rules are contained in a .rules file in the /etc/audit/rules.d/ directory:
grep MAC-policy /etc/audit/rules.d/*.rules
Verify output matches:
-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy
Run the following command to verify that rules are in the running auditd config:
auditctl -l | grep MAC-policy
Verify output matches:
-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy
Expected Result
Output should match the rules listed above.
Remediation
Command Line
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules.
Example: vi /etc/audit/rules.d/50-MAC-policy.rules
Add the following lines:
-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy
Default Value
By default, no audit rules are configured for MAC policy changes.
References
- CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 - Section 4.1.6
CIS Controls
| Controls Version | Control |
|---|
| v7 |
