documentation_complete: true

title: 'Record Events that Modify the System''s Mandatory Access Controls'

description: |-
    If the <tt>auditd</tt> daemon is configured to use the
    <tt>augenrules</tt> program to read audit rules during daemon startup (the
    default), add the following line to a file with suffix <tt>.rules</tt> in the
    directory <tt>/etc/audit/rules.d</tt>:
    {{% if 'ubuntu' in product %}}
    <pre>-w /etc/apparmor/ -p wa -k MAC-policy</pre>
    <pre>-w /etc/apparmor.d/ -p wa -k MAC-policy</pre>
    {{% else %}}
    <pre>-w /etc/selinux/ -p wa -k MAC-policy</pre>
    {{% endif %}}
    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
    utility to read audit rules during daemon startup, add the following line to
    <tt>/etc/audit/audit.rules</tt> file:
    {{% if 'ubuntu' in product %}}
    <pre>-w /etc/apparmor/ -p wa -k MAC-policy</pre>
    <pre>-w /etc/apparmor.d/ -p wa -k MAC-policy</pre>
    {{% else %}}
    <pre>-w /etc/selinux/ -p wa -k MAC-policy</pre>
    {{% endif %}}

rationale: |-
    The system's mandatory access policy (SELinux or Apparmor) should not be
    arbitrarily changed by anything other than administrator action. All changes to
    MAC policy should be audited.

severity: medium

identifiers:
    cce@rhcos4: CCE-82586-9
    cce@rhel8: CCE-80721-4
    cce@rhel9: CCE-83721-1
    cce@rhel10: CCE-87320-8
    cce@sle12: CCE-91601-5
    cce@sle15: CCE-85830-8
    cce@sle16: CCE-95944-5
    cce@slmicro5: CCE-93868-8

references:
    cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
    cis@sle12: 4.1.6
    cis@sle15: 4.1.6
    cjis: 5.4.1.1
    cobit5: APO10.01,APO10.03,APO10.04,APO10.05,APO11.04,APO12.06,APO13.01,BAI03.05,BAI08.02,DSS01.03,DSS01.04,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS03.05,DSS05.02,DSS05.03,DSS05.04,DSS05.05,DSS05.07,MEA01.01,MEA01.02,MEA01.03,MEA01.04,MEA01.05,MEA02.01
    cui: 3.1.8
    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
    isa-62443-2009: 4.2.3.10,4.3.2.6.7,4.3.3.3.9,4.3.3.5.8,4.3.3.6.6,4.3.4.4.7,4.3.4.5.6,4.3.4.5.7,4.3.4.5.8,4.4.2.1,4.4.2.2,4.4.2.4
    isa-62443-2013: 'SR 1.13,SR 2.10,SR 2.11,SR 2.12,SR 2.6,SR 2.8,SR 2.9,SR 3.1,SR 3.5,SR 3.8,SR 4.1,SR 4.3,SR 5.1,SR 5.2,SR 5.3,SR 6.1,SR 6.2,SR 7.1,SR 7.6'
    iso27001-2013: A.11.2.6,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.2.1,A.14.1.3,A.14.2.7,A.15.2.1,A.15.2.2,A.16.1.4,A.16.1.5,A.16.1.7,A.6.2.1,A.6.2.2
    nist: AU-2(d),AU-12(c),CM-6(a)
    nist-csf: DE.AE-3,DE.AE-5,DE.CM-1,DE.CM-3,DE.CM-7,ID.SC-4,PR.AC-3,PR.PT-1,PR.PT-4,RS.AN-1,RS.AN-4
    pcidss: Req-10.5.5

ocil_clause: 'the system is not configured to audit attempts to change the MAC policy'

ocil: |-
    To determine if the system is configured to audit changes to its SELinux
    configuration files, run the following command:
    <pre>$ sudo auditctl -l | grep "dir=/etc/selinux"</pre>
    If the system is configured to watch for changes to its SELinux
    configuration, a line should be returned (including
    <tt>perm=wa</tt> indicating permissions that are watched).
