search

florianutz / Ubuntu1804-CIS

Ubuntu CIS Hardening Ansible Role
MIT License
212 stars 128 forks source link

Add coverage for AppArmor for rule 4.1.7 #80

Closed aircraft-cerier closed 4 years ago

aircraft-cerier commented 4 years ago

Description: Monitor AppArmor mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to /etc/apparmor and /etc/apparmor.d directories.

Remediation: Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules Example: vi /etc/audit/rules.d/MAC-policy.rules and add the following lines:

-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy
aircraft-cerier commented 4 years ago

Covered in pull request: #79