Detections
Analytics
4.1.11 Ensure discretionary access control permission modification events are collected - auditctl b64 chmod fchmod
Information
Monitor changes to file permissions, attributes, ownership and group. The parameters inthis section track changes for system calls that affect file permissions and attributes. The
chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The
chown , fchown , fchownat and lchown system calls affect owner and group attributes on a
file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr ,
lremovexattr , fremovexattr (remove extended file attributes) control extended file
attributes. In all cases, an audit record will only be written for non-system user ids (auid >=
500) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged
with the identifier "perm_mod."
Rationale:
Monitoring for changes in file attributes could alert a system administrator to activity that
could indicate intruder activity or policy violation.
Solution
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in.rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=500 -F
auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F
auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S
removexattr -S lremovexattr -S fremovexattr -F auid>=500 -F auid!=4294967295
-k perm_mod
For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in
.rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:
-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=500 -F
auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=500 -F
auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F
auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F
auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S
removexattr -S lremovexattr -S fremovexattr -F auid>=500 -F auid!=4294967295
-k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S
removexattr -S lremovexattr -S fremovexattr -F auid>=500 -F auid!=4294967295
-k perm_mod
Notes:
Reloading the auditd config to set active settings may require a system reboot.
See Also
Item Details
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6, CSCv6|3.6, CSCv7|5.5
Plugin: Unix
Control ID: 72e6bb816d0655044c688a9f545b4c6a5a460e746a0aeced8863d0f81fecb596