Merge pull request #14367 from Arden97/auditd_var_lib_selinux

jan-cerny · web-flow · commit 7232017ea85a · 2026-02-12T11:28:47.000+01:00
Add audit monitoring for SELinux policy changes in /var/lib/selinux
diff --git a/components/audit.yml b/components/audit.yml
@@ -131,6 +131,7 @@ rules:
 - audit_rules_mac_modification_etc_apparmor_d
 - audit_rules_mac_modification_etc_selinux
 - audit_rules_mac_modification_usr_share
+- audit_rules_mac_modification_var_lib_selinux
 - audit_rules_media_export
 - audit_rules_networkconfig_modification
 - audit_rules_networkconfig_modification_etc_hosts
diff --git a/controls/cis_fedora.yml b/controls/cis_fedora.yml
@@ -2957,6 +2957,7 @@ controls:
       rules:
           - audit_rules_mac_modification_etc_selinux
           - audit_rules_mac_modification_usr_share
+          - audit_rules_mac_modification_var_lib_selinux
 
     - id: 6.3.3.24
       title: Ensure successful and unsuccessful attempts to use the chcon command are collected (Automated)
diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_mac_modification_var_lib_selinux/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_mac_modification_var_lib_selinux/rule.yml
@@ -0,0 +1,36 @@
+documentation_complete: true
+
+title: 'Record Events that Modify the System''s Mandatory Access Controls in /var/lib/selinux'
+
+description: |-
+    {{{ describe_audit_rules_watch("/var/lib/selinux/", "MAC-policy") }}}
+    Note that monitoring /var/lib/selinux/ will generate a significant burst of audit events
+    during both selinux-policy* package upgrade and policy rebuild.
+
+rationale: |-
+    The system's mandatory access policy (SELinux) should not be
+    arbitrarily changed by anything other than administrator action. All changes to
+    MAC policy should be audited.
+
+severity: medium
+
+identifiers:
+    cce@rhel8: CCE-86459-5
+    cce@rhel9: CCE-86461-1
+    cce@rhel10: CCE-86465-2
+
+ocil_clause: 'the system is not configured to audit attempts to change the MAC policy'
+
+ocil: |-
+    To determine if the system is configured to audit changes to its SELinux
+    configuration files, run the following command:
+    <pre>$ sudo auditctl -l | grep "dir=/var/lib/selinux"</pre>
+    If the system is configured to watch for changes to its SELinux
+    configuration, a line should be returned (including
+    <tt>perm=wa</tt> indicating permissions that are watched).
+
+template:
+    name: audit_rules_watch
+    vars:
+        path: "/var/lib/selinux/"
+        key: MAC-policy
diff --git a/shared/checks/oval/audit_rules_auditctl.xml b/shared/checks/oval/audit_rules_auditctl.xml
@@ -18,7 +18,7 @@
     <ind:object object_ref="object_audit_rules_auditctl" />
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="object_audit_rules_auditctl" version="1">
-{{% if product in ['rhel10', 'ol10'] %}}
+{{% if product in ['fedora', 'rhel10', 'ol10'] %}}
     <ind:filepath>/usr/lib/systemd/system/audit-rules.service</ind:filepath>
     <ind:pattern operation="pattern match">^ExecStart=\/sbin\/auditctl.*$</ind:pattern>
   {{% else %}}
diff --git a/shared/checks/oval/audit_rules_augenrules.xml b/shared/checks/oval/audit_rules_augenrules.xml
@@ -18,7 +18,7 @@
     <ind:object object_ref="object_audit_rules_augenrules" />
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="object_audit_rules_augenrules" version="1">
-  {{% if product in ['rhel10', 'ol10']  %}}
+  {{% if product in ['fedora', 'rhel10', 'ol10']  %}}
     <ind:filepath>/usr/lib/systemd/system/audit-rules.service</ind:filepath>
     <ind:pattern operation="pattern match">^ExecStart=(\/usr|)?\/sbin\/augenrules.*$</ind:pattern>
   {{% else %}}
diff --git a/shared/macros/20-test-scenarios.jinja b/shared/macros/20-test-scenarios.jinja
@@ -15,6 +15,23 @@ This macro changes the configuration of the audit service so that it looks like
 {{%- endmacro -%}}
 
 
+{{#
+This macro changes the configuration of the audit service so that it looks like augenrules is used to load rules.
+#}}
+
+{{%- macro setup_augenrules_environment () -%}}
+  {{% if product in ["fedora", "ol10", "rhel10"] %}}
+  sed -i "s%^ExecStart=.*%ExecStart=/sbin/augenrules%" /usr/lib/systemd/system/audit-rules.service
+  {{% else %}}
+  {{% if product == "sle15" %}}
+  sed -i "s%^#ExecStartPost=.*%ExecStartPost=-/sbin/augenrules%" /usr/lib/systemd/system/auditd.service
+  {{% else %}}
+  sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/augenrules%" /usr/lib/systemd/system/auditd.service
+  {{% endif %}}
+  {{% endif %}}
+{{%- endmacro -%}}
+
+
 {{#
 This macro is used by pam_account_password_faillock template to initialize
 the external variable and parameter value to a desired state.
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
@@ -1,6 +1,3 @@
-CCE-86459-5
-CCE-86461-1
-CCE-86465-2
 CCE-86466-0
 CCE-86468-6
 CCE-86469-4
diff --git a/shared/templates/audit_rules_watch/tests/augenrules_correct.pass.sh b/shared/templates/audit_rules_watch/tests/augenrules_correct.pass.sh
@@ -1,6 +1,8 @@
 #!/bin/bash
 # packages = audit
 
+{{{ setup_augenrules_environment() }}}
+
 path={{{ PATH }}}
 style={{{ audit_watches_style }}}
 filter_type={{{ FILTER_TYPE }}}
diff --git a/shared/templates/audit_rules_watch/tests/augenrules_correct_extra_permission.pass.sh b/shared/templates/audit_rules_watch/tests/augenrules_correct_extra_permission.pass.sh
@@ -1,6 +1,8 @@
 #!/bin/bash
 # packages = audit
 
+{{{ setup_augenrules_environment() }}}
+
 path={{{ PATH }}}
 style={{{ audit_watches_style }}}
 filter_type={{{ FILTER_TYPE }}}
diff --git a/shared/templates/audit_rules_watch/tests/augenrules_correct_without_key.pass.sh b/shared/templates/audit_rules_watch/tests/augenrules_correct_without_key.pass.sh
@@ -1,6 +1,8 @@
 #!/bin/bash
 # packages = audit
 
+{{{ setup_augenrules_environment() }}}
+
 path={{{ PATH }}}
 style={{{ audit_watches_style }}}
 filter_type={{{ FILTER_TYPE }}}
diff --git a/shared/templates/audit_rules_watch/tests/augenrules_remove_all_rules.fail.sh b/shared/templates/audit_rules_watch/tests/augenrules_remove_all_rules.fail.sh
@@ -1,6 +1,8 @@
 #!/bin/bash
 # packages = audit
 
+{{{ setup_augenrules_environment() }}}
+
 path={{{ PATH }}}
 style={{{ audit_watches_style }}}
 filter_type={{{ FILTER_TYPE }}}
diff --git a/shared/templates/audit_rules_watch/tests/augenrules_wrong_rule.fail.sh b/shared/templates/audit_rules_watch/tests/augenrules_wrong_rule.fail.sh
@@ -1,6 +1,8 @@
 #!/bin/bash
 # packages = audit
 
+{{{ setup_augenrules_environment() }}}
+
 path={{{ PATH }}}
 style={{{ audit_watches_style }}}
 filter_type={{{ FILTER_TYPE }}}
diff --git a/shared/templates/audit_rules_watch/tests/augenrules_wrong_rule_without_key.fail.sh b/shared/templates/audit_rules_watch/tests/augenrules_wrong_rule_without_key.fail.sh
@@ -1,6 +1,8 @@
 #!/bin/bash
 # packages = audit
 
+{{{ setup_augenrules_environment() }}}
+
 path={{{ PATH }}}
 style={{{ audit_watches_style }}}
 filter_type={{{ FILTER_TYPE }}}
diff --git a/shared/templates/audit_rules_watch/tests/rules_not_there.fail.sh b/shared/templates/audit_rules_watch/tests/rules_not_there.fail.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 # packages = audit
 
+{{{ setup_augenrules_environment() }}}
 
 rm -f /etc/audit/rules.d/*
 > /etc/audit/audit.rules
diff --git a/tests/shared/audit_rules_watch/auditctl_wrong_rule.fail.sh b/tests/shared/audit_rules_watch/auditctl_wrong_rule.fail.sh
@@ -2,8 +2,11 @@
 # packages = audit
 
 if [[ "$style" == "modern" ]] ; then
+    escaped_path=$(echo "$path" | sed 's/\//\\\//g')
+    sed -i "/$filter_type=$escaped_path/d" /etc/audit/audit.rules 
     echo "-a always,exit -F arch=b32 -F $filter_type=$path -F perm=w -F key=logins" >> /etc/audit/audit.rules
     echo "-a always,exit -F arch=b64 -F $filter_type=$path -F perm=w -F key=logins" >> /etc/audit/audit.rules
 else
+    sed -i "\#-w $path#d" /etc/audit/audit.rules
     echo "-w $path -p w -k logins" >> /etc/audit/audit.rules
 fi
diff --git a/tests/shared/audit_rules_watch/auditctl_wrong_rule_without_key.fail.sh b/tests/shared/audit_rules_watch/auditctl_wrong_rule_without_key.fail.sh
@@ -2,8 +2,11 @@
 # packages = audit
 
 if [[ "$style" == "modern" ]] ; then
+    escaped_path=$(echo "$path" | sed 's/\//\\\//g')
+    sed -i "/$filter_type=$escaped_path/d" /etc/audit/audit.rules
     echo "-a always,exit -F arch=b32 -F $filter_type=$path -F perm=w" >> /etc/audit/audit.rules
     echo "-a always,exit -F arch=b64 -F $filter_type=$path -F perm=w" >> /etc/audit/audit.rules
 else
+    sed -i "\#-w $path#d" /etc/audit/audit.rules
     echo "-w $path -p w" >> /etc/audit/audit.rules
 fi
diff --git a/tests/shared/audit_rules_watch/augenrules_wrong_rule.fail.sh b/tests/shared/audit_rules_watch/augenrules_wrong_rule.fail.sh
@@ -3,8 +3,11 @@
 
 
 if [[ "$style" == "modern" ]] ; then
+    escaped_path=$(echo "$path" | sed 's/\//\\\//g')
+    sed -i "/$filter_type=$escaped_path/d" /etc/audit/rules.d/*.rules 2>/dev/null || true
     echo "-a always,exit -F arch=b32 -F $filter_type=$path -F perm=w -F key=logins" >> /etc/audit/rules.d/login.rules
     echo "-a always,exit -F arch=b64 -F $filter_type=$path -F perm=w -F key=logins" >> /etc/audit/rules.d/login.rules
 else
+    sed -i "\#-w $path#d" /etc/audit/rules.d/*.rules 2>/dev/null || true
     echo "-w $path -p w -k login" >> /etc/audit/rules.d/login.rules
 fi
diff --git a/tests/shared/audit_rules_watch/augenrules_wrong_rule_without_key.fail.sh b/tests/shared/audit_rules_watch/augenrules_wrong_rule_without_key.fail.sh
@@ -3,8 +3,11 @@
 
 
 if [[ "$style" == "modern" ]] ; then
+    escaped_path=$(echo "$path" | sed 's/\//\\\//g')
+    sed -i "/$filter_type=$escaped_path/d" /etc/audit/rules.d/*.rules 2>/dev/null || true
     echo "-a always,exit -F arch=b32 -F $filter_type=$path -F perm=w" >> /etc/audit/rules.d/login.rules
     echo "-a always,exit -F arch=b64 -F $filter_type=$path -F perm=w" >> /etc/audit/rules.d/login.rules
 else
+    sed -i "\#-w $path#d" /etc/audit/rules.d/*.rules 2>/dev/null || true
     echo "-w $path -p w" >> /etc/audit/rules.d/login.rules
 fi
