The audit system must be configured to audit modifications to the systems Mandatory Access Control (MAC) configuration (SELinux).
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-38541 | RHEL-06-000183 | SV-50342r1_rule | Low |
| Description |
|---|
| The system's mandatory access policy (SELinux) should not be arbitrarily changed by anything other than administrator action. All changes to MAC policy should be audited. |
| STIG | Date |
|---|---|
| Red Hat Enterprise Linux 6 Security Technical Implementation Guide | 2014-06-10 |
Details
| Check Text ( None ) |
|---|
| None |
| Fix Text (F-43489r1_fix) |
|---|
| Add the following to "/etc/audit/audit.rules": -w /etc/selinux/ -p wa -k MAC-policy |