MEDIUM M18: Session & MAC Audit P3
Overview
Audits session lifecycle events, Mandatory Access Control (MAC) policy modifications, media export operations, and makes audit rules immutable after loading to prevent tampering.
Profile: NIST 800-53 Moderate (rhcos4-moderate)
Compliance Checks
| Check | Description |
|---|---|
session-events |
Audit user session open/close events |
mac-modification |
Audit SELinux/MAC policy changes |
media-export |
Audit removable media mount operations |
immutable |
Make audit rules immutable (requires reboot to change) |
Verification
oc debug node/<node> -- chroot /host auditctl -l | grep -E 'session|MAC|mount|immutable'