# Ensure successful and unsuccessful attempts to use the chcon command are collected

The 'chcon' command is used to change the SELinux security context of files and directories. Monitoring its usage is critical for security. Unauthorized or malicious changes to SELinux contexts can lead to privilege escalation, bypass of access controls, or rendering security mechanisms ineffective. Failure to audit these events creates a significant blind spot, making it difficult to detect and investigate attacks that tamper with the system's mandatory access control policies. The audit script verifies that the system's audit daemon (`auditd`) is configured to log all execution attempts of the 'chcon' command by both administrative (auid=0) and regular users (auid>=1000). The remediation script adds the necessary rules to the auditd configuration to ensure this logging occurs. Since the proper auditing of security context modifications is a fundamental security requirement for systems using SELinux, the recommended state is 'Enabled' across all levels (Basic, Moderate, and Strict). There is no less secure, yet acceptable, configuration; the rule must be in place to ensure system integrity and accountability.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks if the auditd rules for the 'chcon' command are correctly configured. The script should use 'auditctl -l' to list active rules and grep for the patterns '-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=-1 -k perm_mod' and '-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid=0 -k perm_mod'. It must return 'true' if both rules are found, and 'false' otherwise, with no additional text.

## Remediation Script Working

shell script that accepts one argument: 'enabled' or 'disabled'. If the argument is 'enabled', the script must add the following lines to a rule file in '/etc/audit/rules.d/': '-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=-1 -k perm_mod' and '-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid=0 -k perm_mod'. If 'disabled', it should remove them. The script should then reload the auditd rules. It must return 'true' on successful application of the state and 'false' on failure.

