# Ensure Audit Logging of Mandatory Access Control (MAC) Modification Events

- Source: https://support.icompaas.com/support/solutions/articles/62000234911-ensure-audit-logging-of-mandatory-access-control-mac-modification-events
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Linux 2 Benchmark v3.0.0](https://support.icompaas.com/support/solutions/62000112696) › [CIS Amazon Linux 2 Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169265)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability: **• Level 2**

Description:  
 Mandatory Access Controls (MAC) such as SELinux or AppArmor enforce security policies restricting access to system resources. Monitoring changes to MAC policies or configurations is critical to detect unauthorized or malicious modifications.

Rationale:  
 Collecting audit events related to MAC modifications helps maintain policy integrity, detect tampering, and supports forensic investigations.

Impact:  
 Pros:

-   Enhances visibility into critical security policy changes.  
    
-   Supports compliance and security incident response.  
    

Cons:

-   May increase audit log volume; requires proper log management.  
    

Default Value:  
 Audit rules for MAC modifications may not be enabled by default.

Pre-requisites:

-   Root or sudo privileges to configure audit rules.  
    

Remediation:

### Test Plan:

Using Linux command line:

Check existing audit rules related to MAC modifications:

auditctl -l | grep selinux  
auditctl -l | grep apparmor

1.  Verify audit rules exist for monitoring MAC policy changes.  
    

### Implementation Plan:

Using Linux command line:

Add audit rules to monitor MAC configuration files and commands. For example, for SELinux:

auditctl -w /etc/selinux/ -p wa -k MAC-policy  
auditctl -a always,exit -F arch=b64 -S setrlimit -k MAC-policy  

1.  Persist audit rules by adding them to /etc/audit/rules.d/audit.rules.  
    

### Backout Plan:

Using Linux command line:

Remove or disable MAC audit rules if necessary:

auditctl -W /etc/selinux/ -p wa -k MAC-policy  
auditctl -D -k MAC-policy

1.  Reload audit daemon configuration.  
    

References:

-   CIS Amazon Linux 2 Benchmark v3.0.0  
    
-   SELinux Audit  
    
-   [NIST SP 800-53 Revision 5 - AU-6  
      
    ](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final#au-6)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.