Record Events that Modify the System's Discretionary Access Controls - fremovexattr
An XCCDF Rule
Description
At a minimum, the audit system should collect file permission
changes for all users and root.
If the auditd
daemon is configured
to use the augenrules
program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
.rules
in the directory /etc/audit/rules.d
:
-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the
auditd
daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add the following line to
/etc/audit/audit.rules
file:
-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
warning alert: Warning
Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
Rationale
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
- ID
- xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr
- Severity
- Medium
- References
- Updated