# Ensure successful and unsuccessful attempts to use the chcon command are collected

Necessity: The `chcon` command is used to change the SELinux security context of files and directories. Unauthorized or malicious alteration of security contexts can critically weaken system security, allowing attackers to bypass mandatory access controls, escalate privileges, or disrupt system services. Auditing all uses of `chcon` is essential for detecting potential security breaches, unauthorized configuration changes, and providing an immutable log for forensic investigation. Failure to log these events creates a significant gap in security monitoring.

Auditing and Remediation: The audit script verifies that the system's audit daemon (`auditd`) is actively configured with rules to log every execution of the `/usr/bin/chcon` command. The remediation script adds the required rules to the audit configuration files (e.g., `/etc/audit/rules.d/audit.rules`), ensuring they persist across reboots, and then reloads the `auditd` service to apply them immediately.

Recommended State Rationale: A state of `Present` is recommended for all security levels (Basic, Moderate, and Strict). This is a binary control; the rule is either present and effective, or it is not. There is no middle ground for this type of integrity monitoring. For any secure environment, logging all modifications to security contexts is a fundamental requirement as outlined by security benchmarks like CIS. The absence of this rule is a critical vulnerability, making its implementation non-negotiable for even a basic level of hardening.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Present']` |
| **Moderate** | `['Present']` |
| **Strict** | `['Present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the loaded auditd rules using `auditctl -l`. The script must check for the presence of rules that audit the execution of `/usr/bin/chcon` for both 64-bit and 32-bit architectures. If the required rules are found, the script must output `Present`. Otherwise, it must output `Absent`. The output must contain only the resulting string and nothing else.

## Remediation Script Working

Bash script that accepts a single positional argument: `Present` or `Absent`. If the argument is `Present`, the script must add the necessary auditd rules to a file in `/etc/audit/rules.d/` to log all executions of `/usr/bin/chcon` for both 32-bit and 64-bit architectures, and then reload the auditd rules using `augenrules --load`. If the argument is `Absent`, it should remove these specific rules. The script must return `true` upon successful application of the state and `false` on failure.

