# Ensure events that modify the system's Mandatory Access Controls are collected

Necessity: Mandatory Access Control (MAC) systems, such as AppArmor, are a critical security layer that confines programs to a limited set of resources. Monitoring for modifications to MAC policies is essential for system integrity. Any unauthorized or unexpected change to these policies could weaken system defenses, disable protections, or allow an attacker to bypass security controls. Collecting these events ensures a forensic trail exists to detect and investigate potential security breaches or misconfigurations.

Auditing and Remediation: The audit script verifies that `auditd` is actively monitoring the AppArmor policy directories (`/etc/apparmor/` and `/etc/apparmor.d/`) for write access and attribute changes (`-p wa`). The remediation script adds these specific monitoring rules to the auditd configuration, ensuring that any attempt to alter MAC policies is logged.

Recommended State Rationale: The recommendation is 'Present' for all levels because this is a foundational security control. There is no middle ground; either the MAC policies are audited or they are not. 
- Basic: 'Present' is the minimum required state to ensure system integrity monitoring is active. 
- Moderate: This remains 'Present' as the control is a binary on/off setting with no significant performance overhead. 
- Strict: 'Present' is the only acceptable state in a high-security environment. Disabling this audit rule would create a significant blind spot in the system's security posture.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Present']` |
| **Moderate** | `['Present']` |
| **Strict** | `['Present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the loaded auditd rules for the lines `-w /etc/apparmor/ -p wa -k MAC-policy` and `-w /etc/apparmor.d/ -p wa -k MAC-policy`. The script should query the live rules using `auditctl -l`. If both rules are present, the script must return 'Present'. Otherwise, it must return 'Absent'. The output must contain only the string 'Present' or 'Absent' and nothing else.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be the string 'Present'. If the argument is 'Present', the script must ensure the lines `-w /etc/apparmor/ -p wa -k MAC-policy` and `-w /etc/apparmor.d/ -p wa -k MAC-policy` are added to a rule file within `/etc/audit/rules.d/`. If the rules are added or already exist, the script must then reload the auditd configuration (e.g., using `augenrules --load`). The script must return `true` on success and `false` if the input is invalid or the operation fails.

