Detections
Analytics

4.1.9 Ensure discretionary access control permission modification events are collected

Information

Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod fchmod and fchmodat system calls affect the permissions associated with a file. The chown fchown fchownat and lchown system calls affect owner and group attributes on a file. The setxattr lsetxattr fsetxattr (set extended file attributes) and removexattr lremovexattr fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier "perm_mod."

Notes:

 -

Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs
 -

If your systems' UID_MIN is not 1000 replace audit>=1000 with audit>=<UID_MIN for your system> in the Audit and Remediation procedures.

 -

Reloading the auditd config to set active settings may require a system reboot.

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.

Solution

For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending inrules

Example: vi /etc/audit/rules.d/perm_mod.rules

and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending inrules

Example: vi /etc/audit/rules.d/perm_mod.rules

and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

See Also

https://workbench.cisecurity.org/benchmarks/8498

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|5.5

Plugin: Unix

Control ID: 106857edd19f200af5c249cc796bf0fd837c9e246e45411ef3f6735b1f077150