# Ensure events that modify the system's Mandatory Access Controls are collected

Necessity: Mandatory Access Control (MAC) systems, such as SELinux, are a critical security layer that enforces strict information-flow policies. Any modification to these policies could potentially weaken system security, create vulnerabilities, or indicate an active attack. Collecting audit events for any changes to MAC policy files is essential for security monitoring, intrusion detection, and forensic analysis. Failure to log these events creates a significant blind spot, allowing an attacker to disable security controls undetected.

Auditing and Remediation: The audit script inspects the active `auditd` ruleset to verify that it is configured to watch the `/etc/selinux/` directory for any write or attribute change events (`-p wa`). The remediation script modifies the `auditd` rules by adding or removing the specific rule. It ensures the rule is saved in a file within `/etc/audit/rules.d/` for persistence across reboots and reloads the `auditd` service to apply the configuration immediately.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'enabled'. This is a foundational security setting with no valid reason for being disabled in a secure environment. The risk associated with not monitoring changes to the core security policy enforcement mechanism is universally high. Therefore, unlike settings that can be tuned, this audit rule is considered a binary requirement for any level of system hardening.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the currently loaded auditd rules using `auditctl -l`. The script must check for the presence of a rule that monitors the `/etc/selinux/` directory for write and attribute changes, specifically matching the pattern `-w /etc/selinux/ -p wa`. If a matching rule is found, the script should output `true`. If no such rule is found, it should output `false`. The output must contain only this boolean string and no other text.

## Remediation Script Working

Bash script that accepts a single positional argument: `enabled` or `disabled`. If the argument is `enabled`, the script must add the line `-w /etc/selinux/ -p wa -k MAC-policy` to a rule file within `/etc/audit/rules.d/` and then reload the auditd rules to make it active. If the rule already exists, the script should take no action. If the argument is `disabled`, the script must remove the specified rule from the auditd configuration files and reload the rules. The script must return `true` if the operation was successful and `false` if it failed.

