Detections
Analytics

5.2.3.4 Ensure discretionary access control permission modification events are collected

Information

Monitor changes to file permissions, attributes, ownership, and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The following commands and system calls affect the permissions, ownership, and various attributes of files.

 - chmod
 - fchmod
 - fchmodat
 - chown
 - fchown
 - fchownat
 - lchown
 - setxattr
 - lsetxattr
 - fsetxattr
 - removexattr
 - lremovexattr
 - fremovexattr

In all cases, an audit record will only be written for non-system user IDs and will ignore Daemon events.

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.

Solution

Edit the file /etc/security/audit_control, with the relevant rules to monitor events that modify file attributes.

Modify the flags directive to match the following:

flags:fm

These flags should be added if there were other flags previously configured rather than replacing the entire line.

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|5.5

Plugin: Unix

Control ID: 437bc8a5b796af3752fba6945f4898ddb9568479cc17c26336604b5fafe71bb2