Record Events that Modify the System's Mandatory Access Controls
Ensures auditd has an active rule tagged MAC-policy that watches the Mandatory Access Control configuration directories (/etc/selinux/ or /etc/apparmor/, /etc/apparmor.d/) for changes.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The system's Mandatory Access Control policy (SELinux or AppArmor) is a core security boundary and should not be changed by anything other than deliberate administrator action. An attacker who weakens or disables MAC policy can escape confinement; auditing every change to it ensures such tampering is recorded and reviewable.
What Pavois checks
Pavois runs auditctl -l and checks for a loaded rule carrying the MAC-policy key. Reading the live kernel ruleset beats parsing /etc/audit/rules.d/*.rules: a rule present in a file but not loaded gives false assurance. auditctl -l reflects only what the kernel enforces now.
describe command('auditctl -l') do
its('stdout') { should match(/(-k +|key=)MAC\-policy\b/) }
end
describe command("grep -rhwsE 'MAC\-policy' /etc/audit/rules.d/*.rules /etc/audit/audit.rules 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run auditctl -l | grep MAC-policy. On SELinux systems you should see -w /etc/selinux/ -p wa -k MAC-policy; on AppArmor systems -w /etc/apparmor/ -p wa -k MAC-policy and -w /etc/apparmor.d/ -p wa -k MAC-policy. Empty output means the rule is not loaded.
Inspect & investigate
Triggered events land in /var/log/audit/audit.log. Search with grep 'key="MAC-policy"' /var/log/audit/audit.log. MAC subsystem state is also visible via getenforce/sestatus (SELinux) or aa-status (AppArmor) (prefer grep over ausearch -k MAC-policy, which can wrongly report no matches).
Remediation
Pavois's harden plan uses the audit_ruleset resource to write the MAC-policy watch rules (SELinux or AppArmor paths, per OS) into /etc/audit/rules.d/, then reloads auditd. Because the audit config may be immutable, a reboot is required to fully apply. Run pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| reboot_required | true |
|---|---|
| resource | audit_ruleset |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without this rule, an attacker can disable or relax SELinux/AppArmor with no audit trail. The rule is log-only and cannot block policy changes, so it breaks nothing. Precautions: legitimate policy updates (package installs shipping AppArmor profiles, semanage operations) generate events, size audit.log rotation and space_left_action so a full disk does not halt the host when auditd is set to halt.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R73 | direct | 2.0 | high |
| CIS | 10.3.4, 6.3.3.14, 6.3.3.23, 6.2.3.14 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.8, AU-12(c), AU-2(d), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 10.3.4 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.