Auditd and MAC Integration

In this lesson, you will learn how to configure the auditd daemon to capture granular logs whenever your Mandatory Access Control (MAC) system—specifically AppArmor—makes a decision to allow or deny an action.

The Role of Auditd in MAC

While AppArmor profiles are excellent at enforcing security boundaries, they often log decisions to the kernel ring buffer (dmesg or /var/log/syslog). By integrating these events with auditd, you gain a centralized, immutable, and high-fidelity audit trail. This is critical for forensic analysis and verifying that your security policies are behaving as expected under real-world workloads.

Configuring Audit Rules for MAC Decisions

To capture every MAC-related decision, you must instruct auditd to watch the AppArmor status and enforcement hooks. This is done by adding specific rules to your /etc/audit/rules.d/audit.rules file.

Add the following lines to ensure every audit and deny event triggered by the MAC system is recorded:

# Capture all AppArmor policy decisions
-w /sys/kernel/security/apparmor/ -p wa -k mac_policy_change
-a always,exit -F arch=b64 -S apparmor_audit -k mac_denials

Here is the breakdown of what these rules do:

1. -w /sys/kernel/security/apparmor/: This watches the directory where AppArmor stores its internal policy state. The -p wa flags ensure that any write or attribute change to these files is logged.
2. -k mac_policy_change: This attaches a "key" to the log entries. This makes it trivial to filter your logs later using ausearch -k mac_policy_change.
3. -a always,exit: This ensures that every time a syscall related to AppArmor security hooks completes, an audit record is generated, regardless of whether the action was blocked or allowed.

Why this matters

By default, some MAC denials might only show up in system logs, which can be rotated or cluttered with non-security noise. By directing these events through auditd, you ensure that security auditors can use tools like aureport and ausearch to visualize patterns, such as identifying a specific application that is repeatedly attempting to access unauthorized files, signaling a potential compromise or a profile configuration error.

Key Takeaway: Integrating AppArmor with auditd allows you to capture, index, and query security policy enforcement events in a structured format, transforming intermittent system logs into a robust forensic audit trail.