CIS 4.1.3.14 Ensure events that modify the system's Mandatory Access Controls are collected

[marcofortina]

Description of problem:

Check for rule xccdf_org.ssgproject.content_rule_audit_rules_mac_modification always fails on Ubuntu.

SCAP Security Guide Version:

master branch

Operating System Version:

Ubuntu 22.04 LTS

Steps to Reproduce:

1. Create file /etc/audit/rules.d/50-MAC-policy.rules with content:

-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy

2. Merge and load the rules into active configuration: augenrules --load
3. Run SCAP: oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_level2_server --rule xccdf_org.ssgproject.content_rule_audit_rules_mac_modification ssg-ubuntu2204-ds.xml

Actual Results:

Title   Record Events that Modify the System's Mandatory Access Controls
Rule    xccdf_org.ssgproject.content_rule_audit_rules_mac_modification
Result  fail

Expected Results:

Title   Record Events that Modify the System's Mandatory Access Controls
Rule    xccdf_org.ssgproject.content_rule_audit_rules_mac_modification
Result  pass

Additional Information/Debugging Steps:

The check on the audit rule -w /etc/selinux/ -p wa -k MAC-policy on Ubuntu is wrong and should check:

-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy