SV-261468r997405_rule
V-261468
SRG-OS-000062-GPOS-00031
SLEM-05-654225
CAT II
10
Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "setsebool" command.
Add or modify the following lines in the "/etc/audit/rules.d/audit.rules" file:
-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update
To reload the rules file, restart the audit daemon:
> sudo systemctl restart auditd.service
or issue the following command:
> sudo augenrules --load
Verify SLEM 5 generates an audit record for all uses of the "setsebool" command with the following command:
> sudo grep -w "setsebool" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update
If the command does not return a line, or the line is commented out, this is a finding.
Note: The "key=" value is arbitrary and can be different from the example output above.
V-261468
False
SLEM-05-654225
Verify SLEM 5 generates an audit record for all uses of the "setsebool" command with the following command:
> sudo grep -w "setsebool" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update
If the command does not return a line, or the line is commented out, this is a finding.
Note: The "key=" value is arbitrary and can be different from the example output above.
M
5596