Not sure if this is an auditable event.

Any change to the MAC policy such as changing booleans values, changing labels to ports or files, or enforcement of policy should be audited. Basically, if it affects enforcement, we need it. If there is a value to the setting, we need the previous and the new value. I think we are currently using AUDIT_MAC_CONFIG_CHANGE for the event type, which is a kernel event.

semanage fcontext should also generate some kind of audit message.
semanage module generates audit message of MAC_POLICY_LOAD type, but it's not clear which module was enabled or disabled.

The semanage now has AUDIT_ROLE_ASSIGN and AUDIT_ROLE_REMOVE, these definitions have nothing to do with these changes.

If we want to audit other definitions within semanage it would seem that we need new AUDIT records.  Not really sure if we can catch all the data here.  Since loading a kernel module can make similar changes.  Running something that changes the label on an object would be audited if someone was watching.

The problem with this, is we also do not audit chcon commands, which can be used to modify the label on a file.

I still have no information on what AUDIT Message should be sent on these changes.

If you want audit messages particular to ports or other stuff within semanage, we need either new audit message types or someone to define which type I should use.

AUDIT_USER_MAC_CONFIG_CHANGE event identifier added upstream. It can be added to packages like this:

#ifndef AUDIT_USER_MAC_CONFIG_CHANGE
#define AUDIT_USER_MAC_CONFIG_CHANGE 2312
#endif

But I will be updating the audit package with this change.

audit-2.3.2-3.el7 added the new identifier.

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.