{ "id": "CB-UBU-AUDIT-024", "standard": "ubuntu", "version": "0.1.2", "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-AUDIT-024", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-AUDIT-024.json", "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-AUDIT-024.yml", "profiles_effective": [ "server-hardened", "desktop-hardened" ], "license": "Text CC BY 4.0, code Apache-2.0", "attribution": "CIRSEC Baselines, https://baselines.cirsec.org", "control": { "id": "CB-UBU-AUDIT-024", "title": "Audit changes to the AppArmor configuration", "finding": { "title": "Changes to the mandatory access control policy are not recorded", "description": "AppArmor profiles can be weakened or removed without a record." }, "status": "active", "profiles": [ "server-hardened", "desktop-hardened" ], "risk": { "severity": "low" }, "assessment": "automated", "tags": [ "auditd", "apparmor" ], "description": "auditd rules in `/etc/audit/rules.d/60-cirsec-mac.rules`, key `MAC-policy`: writes to\n`/etc/apparmor/` and `/etc/apparmor.d/`, where the AppArmor parser settings and profiles live.\n", "rationale": "Turning a profile to complain mode or deleting it removes the confinement of a service. Recording\nthese changes shows when the protection was lowered and by whom.\n", "impact": "Package upgrades that ship AppArmor profiles produce `MAC-policy` records.\n", "setting": { "location": "/etc/audit/rules.d/60-cirsec-mac.rules", "default_value": "No audit rules", "recommended_value": "Rules loaded (auditctl -l) and present in /etc/audit/rules.d/60-cirsec-mac.rules" }, "audit": { "manual": "1. Run `auditctl -l` as root. It must list the rules shown below (keys `MAC-policy`).\n2. Run `grep -h . /etc/audit/rules.d/*.rules`. The same rules must be present, so they load at boot.\n\nExpected rules, as `auditctl -l` prints them:\n```\n-w /etc/apparmor -p wa -k MAC-policy\n-w /etc/apparmor.d -p wa -k MAC-policy\n```\n", "checks": [ { "id": "rules", "engine": "shell", "description": "Rules loaded in the kernel and present in /etc/audit/rules.d.", "spec": { "script": "command -v auditctl >/dev/null 2>&1 || { echo \"auditctl not found: auditd is not installed\"; exit 1; }\nwant() {\ncat <<'RULES'\n-w /etc/apparmor -p wa -k MAC-policy\n-w /etc/apparmor.d -p wa -k MAC-policy\nRULES\n}\nloaded=$(auditctl -l 2>&1) || { echo \"$loaded\"; exit 3; }\ndisk=$(cat /etc/audit/rules.d/*.rules 2>/dev/null)\nn=0 rc=0\nwhile IFS= read -r r; do\n [ -n \"$r\" ] || continue\n n=$((n + 1))\n printf '%s\\n' \"$loaded\" | grep -Fxq -- \"$r\" || { echo \"not loaded: $r\"; rc=1; }\n printf '%s\\n' \"$disk\" | grep -Fxq -- \"$r\" || { echo \"not in /etc/audit/rules.d: $r\"; rc=1; }\ndone </dev/null 2>&1 || { echo \"auditd is not installed\" >&2; exit 1; }\nwant() {\ncat <<'RULES'\n-w /etc/apparmor -p wa -k MAC-policy\n-w /etc/apparmor.d -p wa -k MAC-policy\nRULES\n}\nf=/etc/audit/rules.d/60-cirsec-mac.rules\nt=$(mktemp)\n{ echo '# Written by CIRSEC Baselines CB-UBU-AUDIT-024'; want; } >\"$t\"\nif ! cmp -s \"$t\" \"$f\"; then\n cb_backup \"$f\"\n cat \"$t\" >\"$f\"\nfi\nrm -f \"$t\"\nchmod 640 \"$f\"\nif auditctl -s | grep -q '^enabled 2'; then\n echo \"audit rules are locked (-e 2): reboot to load $f\"\nelse\n augenrules --load >/dev/null\nfi\n" } ] }, "references": [ { "title": "audit.rules(7), Ubuntu manual pages", "url": "https://manpages.ubuntu.com/manpages/noble/man7/audit.rules.7.html", "publisher": "Canonical", "kind": "vendor-doc", "accessed": "2026-10-19" }, { "title": "auditctl(8), Ubuntu manual pages", "url": "https://manpages.ubuntu.com/manpages/noble/man8/auditctl.8.html", "publisher": "Canonical", "kind": "vendor-doc", "accessed": "2026-10-19" }, { "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R73)", "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf", "publisher": "ANSSI", "kind": "guide", "accessed": "2026-10-19" } ], "mappings": [ { "framework": "anssi-linux", "framework_version": "2.0", "id": "R73", "relation": "partial" }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "AU-12", "relation": "related" } ], "threats": [ { "framework": "mitre-attack", "id": "T1562.001" } ], "related_controls": [ { "id": "CB-UBU-AUDIT-011", "type": "requires" }, { "id": "CB-UBU-AUDIT-029", "type": "related" }, { "id": "CB-UBU-BOOT-008", "type": "related" } ], "authors": [ { "name": "Alice", "github": "Sn0wAlice" } ], "verified": [ { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "20.04" ], "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic", "notes": "Fails after auditd install; rules written and loaded (augenrules), all present in auditctl -l with auditd 2.8.5; passes after reboot with enabled 2." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "22.04" ], "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic", "notes": "Fails after auditd install; rules written and loaded (augenrules), all present in auditctl -l with auditd 3.0.7; passes after reboot with enabled 2." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "24.04" ], "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic", "notes": "Fails after auditd install; rules written and loaded (augenrules), all present in auditctl -l with auditd 3.1.2; passes after reboot with enabled 2." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "26.04" ], "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic", "notes": "Fails after auditd install; rules written and loaded (augenrules), all present in auditctl -l with auditd 4.1.2; passes after reboot with enabled 2." } ], "introduced_in": "0.1.0", "created": "2026-10-19", "updated": "2026-10-19" } }